---
title: Set up an AWS S3 bucket for Jodit Cloud file storage
description: Step by step from an AWS account to a bucket the Jodit Cloud file browser can use: create the bucket, allow public reads on a prefix, create an IAM user with an access key, fill in the cabinet.
keywords: jodit cloud aws setup, s3 bucket jodit, aws bucket policy jodit, iam user jodit files, jodit cloud storage aws
---

# Set up an AWS S3 bucket

This is the AWS side of [File storage](./file-storage.md): an account, a bucket, public reads on one folder, and an access key for the connector. About fifteen minutes if you have never used AWS before.

## 1. Account

Go to https://aws.amazon.com and create an account. AWS asks for an email, a phone number and a card. It charges about 1 USD to check the card and refunds it. The S3 free tier covers 5 GB of storage and 20,000 GET requests a month during the first year, which is plenty for an editor's uploads.

## 2. Bucket

In the console open **S3** and press **Create bucket**.

- Bucket name: something unique across all of AWS, for example `mysite-media`.
- Region: the one closest to your users, for example `eu-central-1` (Frankfurt). Note it down, the cabinet asks for it.
- Object Ownership: leave **ACLs disabled**. The connector does not use ACLs.
- Block Public Access: untick **Block all public access** and confirm. Without this the policy in the next step is refused.
- Leave the rest as it is and press **Create bucket**.

## 3. Let browsers read the files

The editor loads images by URL straight from the bucket, so the folder that will hold the uploads has to be readable by anyone. Open the bucket, go to **Permissions**, then **Bucket policy**, press **Edit** and paste the policy below. Replace the bucket name; `uploads` is the folder (prefix) the connector will write to.

```json
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": "*",
			"Action": "s3:GetObject",
			"Resource": "arn:aws:s3:::mysite-media/uploads/*"
		}
	]
}
```

The public URL of that folder is built from the bucket name and the region:

```
https://mysite-media.s3.eu-central-1.amazonaws.com/uploads/
```

This goes into the **Public URL** field in the cabinet. If you put CloudFront in front of the bucket later, use the CloudFront URL instead and the bucket can stay private.

## 4. An access key for the connector

The connector needs its own user, and that user only has to list the folder and read, write and delete objects in it.

1. Open **IAM**, then **Users**, press **Create user**. Name it `jodit-files`, leave console access off.
2. On the permissions step choose **Attach policies directly**, then **Create policy**, switch to the **JSON** tab and paste:

```json
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": "s3:ListBucket",
			"Resource": "arn:aws:s3:::mysite-media",
			"Condition": {
				"StringLike": { "s3:prefix": ["uploads/*", "uploads"] }
			}
		},
		{
			"Effect": "Allow",
			"Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
			"Resource": "arn:aws:s3:::mysite-media/uploads/*"
		}
	]
}
```

3. Save the policy (name it `jodit-files-uploads`), go back to the user wizard, refresh the policy list, tick the new policy and finish creating the user.
4. Open the user, go to **Security credentials**, press **Create access key** and pick **Application running outside AWS**. Copy both the **Access key ID** and the **Secret access key**. AWS shows the secret once.

## 5. Fill in the cabinet

Open your Cloud key in the [account dashboard](/jodit/pro/cab/) and switch to the **Storage** tab:

| Field                  | Value                                                         |
| ---------------------- | ------------------------------------------------------------- |
| Provider               | Amazon S3                                                     |
| Bucket                 | `mysite-media`                                                |
| Region                 | `eu-central-1`                                                |
| Prefix                 | `uploads`                                                     |
| Public URL             | `https://mysite-media.s3.eu-central-1.amazonaws.com/uploads/` |
| Access key ID / Secret | from step 4                                                   |

Save, then press **Test connection**. The test lists the folder, writes a small marker object and deletes it, so it checks all three permissions at once. Which authorization mode to pick and how to hand tokens to the editor is described in [File storage](./file-storage.md#who-may-use-the-file-browser).

You do not need a CORS configuration on the bucket. Browsers only read images from it by URL; every write goes through the connector.

## If something fails

When Test connection fails at the list step, the `s3:ListBucket` statement is missing, points at the wrong bucket ARN (it has to be the bucket itself, without `/*`), or the region in the cabinet does not match the bucket.

When it fails at the write step, the second statement lacks `s3:PutObject`, or its resource does not cover the prefix you typed in the cabinet.

When images upload but do not show in the editor, open the public URL of an uploaded file in a new tab. A 403 there means Block Public Access is still on, or the bucket policy names a different prefix.

An AccessDenied error while saving the bucket policy means Block Public Access was not turned off in step 2.