Amazon S3 for Craft CMS

This plugin provides an Amazon S3 integration for Craft CMS.

Requirements

This plugin requires Craft CMS 3.1.5 or later.

Installation

You can install this plugin from the Plugin Store or with Composer.

From the Plugin Store

Go to the Plugin Store in your project’s Control Panel and search for “Amazon S3”. Then click on the “Install” button in its modal window.

With Composer

Open your terminal and run the following commands:

# go to the project directory
cd /path/to/my-project.test

# tell Composer to load the plugin
composer require craftcms/aws-s3

# tell Craft to install the plugin
./craft plugin/install aws-s3

Setup

To create a new asset volume for your Amazon S3 bucket, go to Settings → Assets, create a new volume, and set the Volume Type setting to “Amazon S3”.

Tip: The Base URL, Access Key ID, Secret Access Key, Bucket, Region, Subfolder, CloudFront Distribution ID, and CloudFront Path Prefix settings can be set to environment variables. See Environmental Configuration in the Craft docs to learn more about that.

AWS IAM Permissions

Setting up IAM permissions for use with this plugin differs from what options you want to be available.

Generally, you'll want an IAM policy that grants the following actions on the resource(s) that you'll use:

s3:GetBucketLocation
s3:ListBucket
s3:PutObject
s3:GetObject
s3:DeleteObject
s3:GetObjectAcl
s3:PutObjectAcl

If you want to allow the site administrator to list and select the bucket to use, you'll also have to add the s3:ListAllMyBuckets permission to the arn:aws:s3::: resource and the s3:GetBucketLocation permission to the specific bucket resource. Please note, that if a bucket lacks the s3:GetBucketLocation permission, it will not appear in the bucket selection list.

A typical IAM policy that grants the user to choose a bucket can look like this:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "s3:ListAllMyBuckets"
        ],
        "Resource": "*"
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:GetBucketLocation",
            "s3:ListBucket",
            "s3:PutObject",
            "s3:GetObject",
            "s3:DeleteObject",
            "s3:GetObjectAcl",
            "s3:PutObjectAcl"
        ],
        "Resource": [
            "arn:aws:s3:::bucketname/*"
        ]
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:GetBucketLocation",
            "s3:ListBucket"
        ],
        "Resource": [
            "arn:aws:s3:::bucketname"
        ]
    }
]
}

Using the automatic focal point detection

This plugin can use the AWS Rekognition service to detect faces in an image and automatically set the focal point accordingly. This requires the image to be either a jpg or a png file. To enable this feature, just turn it on the volume settings.

⚠️ ️Using this will incur extra cost for each upload

⚠️ ️Using this requires the rekognition:DetectFaces action to be allowed.

Assuming Role with OIDC

This plugin also has the ability to assume a role provided to the runtime with the AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN environment variables. If you provide no credentials to AWS and these environment variables exist, then the plugin will attempt to create a connection to AWS using the CredentialProvider::assumeRoleWithWebIdentityCredentialProvider. This is the ideal way to allow fine-grained access control for hosting CraftCMS in Kubernetes (for example). See the IAM documentation on AWS for more details.

Mosnar / aws-s3