This plugin provides an Amazon S3 integration for Craft CMS.
This plugin requires Craft CMS 3.1.5 or later.
You can install this plugin from the Plugin Store or with Composer.
Go to the Plugin Store in your project’s Control Panel and search for “Amazon S3”. Then click on the “Install” button in its modal window.
Open your terminal and run the following commands:
# go to the project directory
cd /path/to/my-project.test
# tell Composer to load the plugin
composer require craftcms/aws-s3
# tell Craft to install the plugin
./craft plugin/install aws-s3
To create a new asset volume for your Amazon S3 bucket, go to Settings → Assets, create a new volume, and set the Volume Type setting to “Amazon S3”.
Tip: The Base URL, Access Key ID, Secret Access Key, Bucket, Region, Subfolder, CloudFront Distribution ID, and CloudFront Path Prefix settings can be set to environment variables. See Environmental Configuration in the Craft docs to learn more about that.
Setting up IAM permissions for use with this plugin differs from what options you want to be available.
Generally, you'll want an IAM policy that grants the following actions on the resource(s) that you'll use:
s3:GetBucketLocation
s3:ListBucket
s3:PutObject
s3:GetObject
s3:DeleteObject
s3:GetObjectAcl
s3:PutObjectAcl
If you want to allow the site administrator to list and select the bucket to use, you'll also have to add the s3:ListAllMyBuckets
permission to the arn:aws:s3:::
resource and the s3:GetBucketLocation
permission to the specific bucket resource. Please note, that if a bucket lacks the s3:GetBucketLocation
permission, it will not appear in the bucket selection list.
A typical IAM policy that grants the user to choose a bucket can look like this:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:ListBucket",
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject",
"s3:GetObjectAcl",
"s3:PutObjectAcl"
],
"Resource": [
"arn:aws:s3:::bucketname/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::bucketname"
]
}
]
}
This plugin can use the AWS Rekognition service to detect faces in an image and automatically set the focal point accordingly. This requires the image to be either a jpg or a png file. To enable this feature, just turn it on the volume settings.
rekognition:DetectFaces
action to be allowed.
This plugin also has the ability to assume a role provided to the runtime with the AWS_WEB_IDENTITY_TOKEN_FILE
and AWS_ROLE_ARN
environment variables. If you provide no credentials to AWS and these environment variables exist, then the plugin will attempt to create a connection to AWS using the CredentialProvider::assumeRoleWithWebIdentityCredentialProvider
. This is the ideal way to allow fine-grained access control for hosting CraftCMS in Kubernetes (for example). See the IAM documentation on AWS for more details.