About 10 minutes

How to use Aktar with Amazon S3

Q: Uploads fail with Access Denied

The IAM user needs s3:PutObject on YOUR-BUCKET/* and s3:ListBucket on the bucket itself.

Amazon S3 is the original object storage and works with Aktar's Amazon S3 preset. The only part that needs care is public access: S3 blocks it by default, so you either add a bucket policy for public reads or put CloudFront in front of the bucket.

What you need

An AWS account
Permission to create S3 buckets and IAM users
Aktar installed on your Mac

Step by step

1
Create a bucket
In the S3 console, click Create bucket, choose a globally unique name and the region closest to you, for example eu-central-1. You can keep the default "Bucket owner enforced" object ownership: Aktar doesn't use ACLs.
2
Allow public reads
Option A, bucket policy: in the bucket's Permissions tab, turn off the "Block public access" settings that block public bucket policies, then add this bucket policy (replace YOUR-BUCKET):
```
{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "PublicRead",
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::YOUR-BUCKET/*"
  }]
}
```
Option B, CloudFront: keep the bucket private and create a CloudFront distribution with the bucket as origin (using Origin Access Control). This gives you HTTPS on a custom domain and caching.

Create an IAM user for Aktar

In IAM, create a user and attach a policy that only allows what Aktar needs on that bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::YOUR-BUCKET" },
    { "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::YOUR-BUCKET/*" }
  ]
}

Then create an access key for the user and copy the Access Key ID and Secret Access Key.

4
Add the destination in Aktar
In Settings → Destinations → Add Destination, choose Amazon S3 and enter the values below. The endpoint and region must match the bucket's region.
5
Test and save
Click Test Connection to confirm the bucket is writable and the public URL serves files, then Save.

Settings in Aktar

Enter these values in Settings → Destinations → Add Destination. Field names match the app.

Field	Example value
Provider	`Amazon S3`
Endpoint	`https://s3.eu-central-1.amazonaws.com`Use your bucket's region.
Region	`eu-central-1`
Access Key ID	`AKIA…`From the IAM user.
Secret Access Key	`••••••••`
Bucket	`your-bucket`
Public Base URL	`your-bucket.s3.eu-central-1.amazonaws.com`Or your CloudFront domain.

Tips

Prefer CloudFront with a custom domain if you share links publicly: you get caching and can keep the bucket itself private.
Scope the IAM policy to a single bucket. Aktar never needs account-wide permissions.
Choose a region close to you for faster uploads, and close to your audience if you don't use a CDN.

Troubleshooting

Test Connection reports an error about the region or a redirect

The endpoint and region must match the region the bucket was created in, for example https://s3.eu-central-1.amazonaws.com with eu-central-1.

Uploads fail with Access Denied

The IAM user needs s3:PutObject on YOUR-BUCKET/* and s3:ListBucket on the bucket itself.

Links return 403

The bucket policy is missing or still blocked by "Block public access", or CloudFront can't read the bucket. See Access Denied errors.

Still stuck?Browse the FAQ or ask on GitHub.