Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm thinking about signing up to the Amazon S3 storage service.

What I want to do is create a service where other people can register their own bucket with a certain amount of storage.

These users will install my software, which then uploads their files. Of course, the users may only upload what they have paid for.

For this to work I would like to create a separate bucket for each customer, each with its own properties. Question 1: is this possible with the API? How?

This means that the installed software must have the rights needed to upload to my Amazon S3 account. Question 2: can I create individual authentication IDs for each bucket or customer, so that they can only upload with restrictions I have set?

Important info: I am a European resident and cannot do business in the United States, this means that I cannot use Amazon's DevPay service.

Update: looks like Amazon has a 100 buckets limit. This is not my service it seems.

Thanks in advance.

share|improve this question

You can always hide the buckets behind a virtualization app (a HTTP front end, an FTP one, or something custom). But that means you would have to burn CPU, probably on an EC2 instance, to map these requests and copy bytes in/out of those S3 buckets.

Exposing an S3 bucket directly to a user would have to follow the S3 security rules:

How can I control access to my data stored on Amazon S3?
Customers may use three mechanisms for controlling access to Amazon S3 resources: bucket policies, Access Control Lists (ACLs) and query string authentication. With bucket policies, companies can define rules which apply broadly across all requests to their Amazon S3 resources, such as granting write privileges to a subset of Amazon S3 resources. Customers can also restrict access based on an aspect of the request, such as HTTP referrer and IP address. With ACLs, customers can grant specific permissions (i.e. READ, WRITE, FULL_CONTROL) to specific users for an individual bucket or object. With query string authentication, customers can create a URL to an Amazon S3 object which is only valid for a limited time.

share|improve this answer
Thanks, but could you please clarify if I can create a bucket policy that restrits a user to only upload to a certain bucket with a maximum storage and monthly transfer amount? Where do you read this? – Tom Dec 29 '10 at 19:06
Afaik to put such traffic/size restriction in effect you must have your own front end that exposes the 'service' and access S3 from behind this front end. – Remus Rusanu Dec 29 '10 at 19:12
@Remus Rusanu, is that the only way? That would be almost undoable, because it would rain way too much server resources and bandwidth inbetween. – Tom Dec 29 '10 at 19:25
If your customers have each an AWS account then you can expose the S3 directly and control via ACLs. Other solutions are not exactly bulletproof: HTTP referrer can be spoofed, IP restrictions are unreliable with customers behind NATs and impossible to maintain, query string authentication and limited time access has only a few limited use cases when it can be used. I'm curious myself if someone has a solution that safely exposes the S3 bucket directly, but I'm not aware of any. – Remus Rusanu Dec 29 '10 at 20:31
@Remus Rusana, what kind of AWS account do they need? How does this work? If you mean a master AWS account for developers, like I have, that really is not an option. This is a service for non-technical consumers. This is rather disappointing. – Tom Dec 29 '10 at 20:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.