AWS S3 Storage

​

Step 1: Create an S3 Bucket

​

Via the AWS CLI

aws s3api create-bucket \
  --bucket <bucket-name> \
  --region us-east-1

aws s3api create-bucket \
  --bucket <bucket-name> \
  --region us-west-2 \
  --create-bucket-configuration LocationConstraint=us-west-2

​

Via the AWS Console

1. Go to S3 → Create bucket
2. Enter a Bucket name (globally unique)
3. Select your AWS Region
4. Leave all other settings as default and click Create bucket

​

Step 2: Create IAM Credentials

​

Via the AWS CLI

# Create the IAM user
aws iam create-user --user-name tembo-storage

# Create an inline policy granting access to the bucket
aws iam put-user-policy \
  --user-name tembo-storage \
  --policy-name tembo-s3-access \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::<bucket-name>",
        "arn:aws:s3:::<bucket-name>/*"
      ]
    }]
  }'

# Create access keys
aws iam create-access-key --user-name tembo-storage

​

Via the AWS Console

1. Go to IAM → Users → Create user
2. Enter a username (e.g. tembo-storage) and click Next
3. Select Attach policies directly, then click Create policy
4. In the policy editor, paste:
   {
     "Version": "2012-10-17",
     "Statement": [{
       "Effect": "Allow",
       "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket"],
       "Resource": [
         "arn:aws:s3:::<bucket-name>",
         "arn:aws:s3:::<bucket-name>/*"
       ]
     }]
   }
   
5. Name the policy (e.g. tembo-s3-access) and click Create policy
6. Back on the user creation page, attach the new policy and click Next → Create user
7. Open the user, go to the Security credentials tab, and click Create access key
8. Select Application running outside AWS, then click Next → Create access key
9. Copy the Access key and Secret access key

​

Step 3: Configure CORS

​

Via the AWS CLI

aws s3api put-bucket-cors \
  --bucket <bucket-name> \
  --cors-configuration '{
    "CORSRules": [{
      "AllowedOrigins": ["http://<instance-ip>"],
      "AllowedMethods": ["GET", "PUT", "DELETE", "HEAD"],
      "AllowedHeaders": ["*"],
      "ExposeHeaders": [],
      "MaxAgeSeconds": 3600
    }]
  }'

​

Via the AWS Console

1. Go to S3 → select your bucket → Permissions tab
2. Scroll to Cross-origin resource sharing (CORS) and click Edit
3. Paste:
   [
     {
       "AllowedOrigins": ["http://<instance-ip>"],
       "AllowedMethods": ["GET", "PUT", "DELETE", "HEAD"],
       "AllowedHeaders": ["*"],
       "ExposeHeaders": [],
       "MaxAgeSeconds": 3600
     }
   ]
   
4. Click Save changes

​

Step 4: Add to config.json

{
  "selfHosted.objectStorage.provider": "aws",
  "selfHosted.objectStorage.bucket": "<bucket-name>",
  "aws.region": "us-east-1",
  "selfHosted.objectStorage.aws.accessKeyId": "<access-key-id>",
  "selfHosted.objectStorage.aws.secretAccessKey": "<secret-access-key>"
}

sudo systemctl restart 'tembo-ts-*'