26

In the past S3 supported FQDN bucket names - i.e. exactly what you needed. Where FQDN = Fully Qualified Domain Name, i.e. full host name like static.mypage.com. The problem is that this only works with HTTP and not with HTTPS because there is no way to make S3 use a SSL certificate with your bucket name / host name (static.mypage.com). You can still do it if ...


7

You can actually connect to S3 bucket from EC2 instance. https://aws.amazon.com/premiumsupport/knowledge-center/ec2-instance-access-s3-bucket/ So you can build it. However, in case you have Veeam Enterprise and Enterprise Plus editions you can use SOBR to configure AWS S3 as a backup repository. https://helpcenter.veeam.com/docs/backup/vsphere/...


5

It was necessary to enable public access on the bucket and then I was able to save the bucket policy. This is the policy I was adding. { "Version": "2012-10-17", "Statement": [ { "Sid": "PublicReadGetObject", "Effect": "Allow", "Principal": "*",...


3

I think this may be a case of mismatched expectations regarding what functionality S3 provides. S3 does not actually have any structure, the bucket just has a flat set of objects with the full string that might be seen as the "path" being the key of each object. The ListObjectsV2 API action however provides features like specifying a prefix (only ...


3

You have shown a screenshot of your Storage Lens account snapshot, which gives you a summary of what is in all the S3 buckets in your account. You can see that you have consumed 3.2 petabytes of storage using 2.3 billion objects with an average object size of 1.5 megabytes. In this case the G simply means giga, or billion.


2

As a complement to @sippybear's excellent answer, I would recommend the following, if somebody has a bucket with a trillion objects and the pattern of the files one wants to delete includes "parent directories", e.g. 'my/path/to/topdir/abc_1*': aws s3 rm --dryrun --recursive --exclude '*' --include 'abc_1*' s3://mybucket/my/path/to/topdir/ Why? ...


2

There’s none. Stick with S3 Browser as other options suck even more. Say CloudBerry has data integrity issues so things you copy to AWS or back on-site might come up damaged. Good review of the popular tools with the functionality you want is here: https://proprivacy.com/cloud/comparison/amazon-s3-user-interface-tools


2

So you can download files made public but not browse S3 folders? S3 doesn't have folders, it has objects with keys that can be viewed as / thought of as folders. In short, you can't browse to what looks like an S3 folder because it doesn't actually exist. What exactly are you trying to achieve? Make S3 work like a web interface to a standard file share? ...


2

You don't need to invite the second person AWS account into your organization. In order to grant access to the second user to the first person AWS account you have two main options: create an IAM user - As suggested in the answer from @Tim you can simply create an IAM user for the second person in the first person AWS account. use a cross-account IAM role - ...


2

This question doesn't really make sense to me. If you want a second person to have access to the AWS resources simply go into AWS IAM and create them an IAM user. Make sure you set up MFA. AWS Organisations is very useful but based on what little I understand about your question isn't relevant at all. The first user should NOT be using the root account. ...


2

Maybe a little late to the party but since majority of the answers are very old; just wanted to share the command that works right now :- So, to manually mount the s3 bucket using an IAM role you will need to fire the following command :- $ sudo s3fs <bucket-name> /<folder-path>/<folder-name> -o iam_role="<Role-name>" -o url=...


1

Is it possible that you have the Object Lock (WORM) feature enabled? That would block delete operations.


1

You are on the right track in general. Just one comment: Route53 can be omitted if your domain uses some other DNS service provider already. Q: Does the "bucket name == domain name" requirement apply even if I use CloudFront ? No, if you use CloudFront. The CNAME is configured separately in CloudFront. Q: Do I need to create one bucket each for ...


1

Via the AWS Console it's not possible if the IAM User has no console permissions. Use S3 Tool e.g. s3browser, cyberduck or the awscli. List of tools https://aws-blog.de/amazon-aws-tools.html https://proprivacy.com/cloud/comparison/amazon-s3-user-interface-tools


1

Logon to your web host control panel and select “Manage DNS Server Settings” or similar Create a new CNAME entry for your domain. For your example of static.mypage.com, the entry is: Name: static Type: CNAME Value: s3-external-3.amazonaws.com. (If you are an American user, use s3.amazonaws.com. instead) And yes, the dot at the end of “s3-external-3....


1

Use an AWS Service Control Policy, attached to your AWS Organisation OUs. The snippet below only enforces S3 encryption in transit, but you can also enforce: S3 / EBS / RDS encryption at rest (probably other services too) Allowed EC2 sizes / families Creation of default VPCs Disabling default EBS encryption Deactivation of security services Root user doing ...


1

WINDOWS / POWERSHELL If the lifecycle indication does not suit you, then on Windows Server this can be done by writing a simple PowerShell script #set a bucket name $bucket = "my-bucket-name" #set the expiration date of files $limit_date = (Get-Date).AddDays(-30) #get all the files $files = aws s3 ls "$($bucket)" #extract the file name ...


1

Yes. All the data that has been synchronized to S3 will be available in a new gateway you setup and connect to that bucket.


1

I found this question while having the same issue. What ended up solving it for me is this answer which I have quoted below so as to not have an answer with just a link. There is a script call InitializeInstance.ps1 that resets some configuration information. For example, if the instance has changed subnets it might not work correctly due to cached routing ...


1

you need proxy_set_header Host "cdn domain" ; to rewrite your nginx request host from nginx to cdn


1

There is another simpler solution that works for me with the use of a HTML attribute called crossorigin='anonymous' as detailed here. Basically you can add this attribute as such: <img src="your_image_url_here" crossorigin='anonymous'> and this would essentially makes your "first" request to the image a CORS request, now if you try ...


1

Please see AWS Docs: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-cli-package.html https://docs.aws.amazon.com/cli/latest/reference/cloudformation/package.html For some resource properties that require an Amazon S3 location (a bucket name and filename), you can specify local references instead. For example, you might specify the ...


1

Elaborating on @m-glatki solution, add a policy on the bucket that restricts S3 access to a particular VPC Endpoint: { "Version": "2008-10-17", "Statement": [ { "Effect": "Deny", "Principal": "*", "Action": "s3:ListBucket&...


1

Second command worked fine for me aws s3api put-bucket-lifecycle-configuration --bucket <bucket> --lifecycle-configuration file://<file> Where <file> is the file obtained with this command aws s3api get-bucket-lifecycle-configuration --bucket <bucket-old> ><file>


1

I came across this problem today, where some font files (*.woff/*woff2) on S3 being served via CloudFront had lost their Access-Control-Allow-Origin response header, resulting in CORS errors from web browsers. I expect a web crawler (or something else) had requested the files without the Origin request header present, resulting in a cached copy of the fonts ...


1

This appear to now be possible. With s3cmd v1.6.1: curl -v "http://remote-server/file.mp4" | s3cmd [-c .s3cfg-aws] put - [-P] s3://my-bucket/[folder/]filename.mp4


1

My issue was that I had turned website hosting off and had to change the origin name from the website path to the normal non-website one. That had removed the origin access identity. I put that back and everything worked fine.


Only top voted, non community-wiki answers of a minimum length are eligible