S3 Quick Start¶

This guide covers the basic steps required to start using the S3 service.

The examples use the AWS CLI.

Service Information¶

Prerequisites¶

Install the AWS CLI and verify the installation:

aws --version

You need the following credentials:

• Root access key
• Root secret key

Official AWS documentation:

• Installing the AWS CLI
• AWS CLI configuration

1. Configure Root Access¶

Configure the AWS CLI profile:

aws configure --profile my-netde-account-root

Enter your credentials and region:

AWS Access Key ID:     <ROOT_ACCESS_KEY>
AWS Secret Access Key: <ROOT_SECRET_KEY>
Default region name:   de-han-1
Default output format: json

Configure the S3 endpoint:

aws configure set endpoint_url https://s3.net.de \
    --profile my-netde-account-root

Test the connection:

aws --profile my-netde-account-root s3api list-buckets

The root credentials have administrative privileges. Use dedicated IAM users for applications and regular S3 access.

Official AWS documentation:

• AWS CLI configuration
• AWS CLI endpoints
• S3 list-buckets

2. Create IAM Users¶

In this example, two users are created:

Create the Read/Write User¶

aws --profile my-netde-account-root iam create-user \
    --user-name app-rw

Create an access key:

aws --profile my-netde-account-root iam create-access-key \
    --user-name app-rw

The response contains an AccessKeyId and SecretAccessKey.

Example:

{
  "AccessKey": {
    "UserName": "app-rw",
    "AccessKeyId": "<ACCESS_KEY>",
    "SecretAccessKey": "<SECRET_KEY>",
    "Status": "Active"
  }
}

Store both values securely.

Create the Read-Only User¶

aws --profile my-netde-account-root iam create-user \
    --user-name app-ro

Create an access key:

aws --profile my-netde-account-root iam create-access-key \
    --user-name app-ro

Store the returned credentials securely.

Official AWS documentation:

• IAM create-user
• IAM create-access-key
• IAM users

3. Create a Bucket¶

Create a bucket called customer-data:

aws --profile my-netde-account-root s3api create-bucket \
    --bucket customer-data \
    --region de-han-1

List the available buckets:

aws --profile my-netde-account-root s3api list-buckets

Check access to the bucket:

aws --profile my-netde-account-root s3api head-bucket \
    --bucket customer-data

Official AWS documentation:

• S3 create-bucket
• S3 list-buckets
• S3 head-bucket
• Working with S3 buckets

4. Grant Read/Write Access¶

Create a file named customer-data-rw.json:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BucketAccess",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": "arn:aws:s3:::customer-data"
    },
    {
      "Sid": "ObjectAccess",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::customer-data/*"
    }
  ]
}

Attach the policy to app-rw:

aws --profile my-netde-account-root iam put-user-policy \
    --user-name app-rw \
    --policy-name customer-data-rw \
    --policy-document file://customer-data-rw.json

The user can now:

• List objects
• Download objects
• Upload objects
• Delete objects

The permissions apply only to customer-data.

Official AWS documentation:

• IAM put-user-policy
• S3 identity-based policy examples
• S3 actions, resources and condition keys
• IAM policies and permissions

5. Grant Read-Only Access¶

Create a file named customer-data-ro.json:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BucketAccess",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": "arn:aws:s3:::customer-data"
    },
    {
      "Sid": "ObjectAccess",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::customer-data/*"
    }
  ]
}

Attach the policy:

aws --profile my-netde-account-root iam put-user-policy \
    --user-name app-ro \
    --policy-name customer-data-ro \
    --policy-document file://customer-data-ro.json

The resulting permissions are:

Official AWS documentation:

• IAM put-user-policy
• S3 identity-based policy examples
• IAM least-privilege permissions

6. Configure the IAM Users¶

Read/Write User¶

aws configure --profile app-rw

Enter:

AWS Access Key ID:     <APP_RW_ACCESS_KEY>
AWS Secret Access Key: <APP_RW_SECRET_KEY>
Default region name:   de-han-1
Default output format: json

Configure the endpoint:

aws configure set endpoint_url https://s3.net.de \
    --profile app-rw

Read-Only User¶

aws configure --profile app-ro

Enter:

AWS Access Key ID:     <APP_RO_ACCESS_KEY>
AWS Secret Access Key: <APP_RO_SECRET_KEY>
Default region name:   de-han-1
Default output format: json

Configure the endpoint:

aws configure set endpoint_url https://s3.net.de \
    --profile app-ro

Official AWS documentation:

• AWS CLI named profiles
• AWS CLI endpoint configuration

7. Upload and Download Objects¶

Create a test file:

echo "Hello S3" > test.txt

Upload¶

aws --profile app-rw s3 cp \
    test.txt s3://customer-data/test.txt

List¶

aws --profile app-rw s3 ls \
    s3://customer-data/

Download¶

aws --profile app-rw s3 cp \
    s3://customer-data/test.txt downloaded.txt

Delete¶

aws --profile app-rw s3 rm \
    s3://customer-data/test.txt

Official AWS documentation:

• AWS CLI S3 commands
• S3 cp
• S3 ls
• S3 rm
• Working with S3 objects

8. Test Read-Only Access¶

Make sure a test object exists:

aws --profile app-rw s3 cp \
    test.txt s3://customer-data/test.txt

Listing should succeed:

aws --profile app-ro s3 ls \
    s3://customer-data/

Downloading should succeed:

aws --profile app-ro s3 cp \
    s3://customer-data/test.txt .

Uploading should fail with AccessDenied:

aws --profile app-ro s3 cp \
    test.txt s3://customer-data/readonly-test.txt

Deleting should also fail with AccessDenied:

aws --profile app-ro s3 rm \
    s3://customer-data/test.txt

Official AWS documentation:

• S3 policy actions
• S3 policy examples
• IAM policy evaluation

9. Bucket Versioning¶

Create another bucket:

aws --profile my-netde-account-root s3api create-bucket \
    --bucket customer-archive \
    --region de-han-1

Enable versioning:

aws --profile my-netde-account-root s3api put-bucket-versioning \
    --bucket customer-archive \
    --versioning-configuration Status=Enabled

Check the versioning configuration:

aws --profile my-netde-account-root s3api get-bucket-versioning \
    --bucket customer-archive

Expected result:

{
  "Status": "Enabled"
}

Upload the first version:

echo "Version 1" > example.txt

aws --profile my-netde-account-root s3 cp \
    example.txt s3://customer-archive/example.txt

Upload another version:

echo "Version 2" > example.txt

aws --profile my-netde-account-root s3 cp \
    example.txt s3://customer-archive/example.txt

List all versions:

aws --profile my-netde-account-root s3api list-object-versions \
    --bucket customer-archive

Official AWS documentation:

• S3 Versioning
• S3 put-bucket-versioning
• S3 get-bucket-versioning
• S3 list-object-versions

10. Public Read Access¶

Warning: Public access makes objects accessible without authentication. Only enable public access when it is explicitly required.

Create a public bucket:

aws --profile my-netde-account-root s3api create-bucket \
    --bucket customer-public \
    --region de-han-1

Create a file named public-read.json:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicRead",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::customer-public/*"
    }
  ]
}

Apply the bucket policy:

aws --profile my-netde-account-root s3api put-bucket-policy \
    --bucket customer-public \
    --policy file://public-read.json

Upload an object:

echo "Hello World" > public.txt

aws --profile my-netde-account-root s3 cp \
    public.txt s3://customer-public/public.txt

The policy grants only:

s3:GetObject

Anonymous users are not granted permission to:

• List objects
• Upload objects
• Modify objects
• Delete objects

Official AWS documentation:

• S3 bucket policies
• S3 bucket policy examples
• S3 put-bucket-policy
• S3 public access

11. Common S3 Commands¶

List Buckets¶

aws --profile my-netde-account-root s3 ls

Create a Bucket¶

aws --profile my-netde-account-root s3api create-bucket \
    --bucket my-bucket \
    --region de-han-1

List Objects¶

aws --profile app-rw s3 ls \
    s3://customer-data/

Upload an Object¶

aws --profile app-rw s3 cp \
    file.txt s3://customer-data/

Download an Object¶

aws --profile app-rw s3 cp \
    s3://customer-data/file.txt .

Delete an Object¶

aws --profile app-rw s3 rm \
    s3://customer-data/file.txt

Upload a Directory¶

aws --profile app-rw s3 cp \
    ./data/ s3://customer-data/data/ \
    --recursive

Download a Directory¶

aws --profile app-rw s3 cp \
    s3://customer-data/data/ ./data/ \
    --recursive

Synchronize a Directory¶

aws --profile app-rw s3 sync \
    ./data/ s3://customer-data/data/

Official AWS documentation:

• AWS CLI high-level S3 commands
• S3 cp
• S3 sync
• S3 API commands

12. Permission Basics¶

S3 distinguishes between bucket permissions and object permissions.

Bucket Permissions¶

Bucket permissions use:

arn:aws:s3:::customer-data

Common actions:

s3:ListBucket
s3:GetBucketLocation

Object Permissions¶

Object permissions use:

arn:aws:s3:::customer-data/*

Common actions:

s3:GetObject
s3:PutObject
s3:DeleteObject

GetObject and ListBucket are separate permissions.

A user may therefore be able to download a known object while not having permission to list the bucket.

Official AWS documentation:

• S3 actions, resources and condition keys
• S3 identity-based policy examples
• Identity-based and resource-based policies

13. Security Recommendations¶

The root credentials should only be used for administrative tasks.

Applications should use dedicated IAM users with restricted permissions.

Recommended practices:

• Do not use root credentials in applications.
• Create dedicated IAM users for applications.
• Grant only the permissions an application requires.
• Restrict IAM policies to specific buckets.
• Use separate access keys for separate applications.
• Store secret keys securely.
• Never commit secret keys to Git repositories.
• Disable or remove access keys that are no longer required.
• Do not make buckets public unless public access is explicitly required.

Official AWS documentation:

• IAM security best practices
• Least-privilege permissions
• S3 security best practices

Quick Reference¶

Root profile configuration:

[profile my-netde-account-root]
region = de-han-1
output = json
endpoint_url = https://s3.net.de

Test connectivity:

aws --profile my-netde-account-root s3api list-buckets

Official AWS documentation:

• AWS CLI configuration files
• AWS CLI S3 command reference
• AWS CLI S3 API command reference
• AWS CLI IAM command reference