Amazon S3 bucket

Store your app’s files in your own Amazon S3 bucket.

⏱ About 15 minutes

With File Storage, your users’ files (photos, documents) go straight from their device into your bucket using short-lived signed links. Claspine never stores file contents; it only keeps track of the files. You create the bucket and a dedicated AWS user that can only touch your project’s folder in it.

Words you’ll see

Bucket: A storage container for files at a storage provider, like a top-level folder in the cloud. Your app’s uploads go into it.
IAM user: In AWS, a separate login made for one purpose, with only the permissions you give it. Your own (root) login can do everything, so it should never be handed to any service.
Policy: A short list of what a user or key is allowed to do, written as JSON. You paste the one from the guide; it allows only what Claspine needs.
Access key ID and secret access key: A pair of values that works like a username and password for programs. The ID can be shown; the secret is shown once when you create it.
Region: The part of the world where the provider runs your service, such as us-east-1 (Virginia) or europe-west4 (Netherlands). Use the region where you set things up.
Endpoint: The web address Claspine uses to reach your storage provider, such as https://s3.us-east-1.amazonaws.com.
Signed URL: A web link that allows one upload or download for a few minutes. Claspine creates these so files travel directly between your users and your bucket without passing through Claspine.
CORS: A browser safety setting on the bucket that says which websites may upload or download directly. Without it, browsers block uploads from your app.

Steps

Open the S3 console and click Create bucket. Pick a name and a region, keep Block all public access switched on, and create it.
Open the IAM console → Users → Create user, name it spine-storage, and leave console access unticked.
Create the user, then open it and choose Add permissions → Create inline policy → JSON.
Paste the policy below. Replace <bucket> with your bucket name and <project-id> with your Claspine project ID (the File Storage page shows the policy already filled in). Save it.
In the user’s Security credentials, click Create access key, choose Application running outside AWS, and copy both values.
Open your bucket → Permissions → Cross-origin resource sharing (CORS) and paste the rule shown on Claspine’s File Storage page, with your app’s web address. This lets browsers upload to the bucket.
Open the Claspine console, choose your project and go to File Storage.
Pick this provider in the list, then fill in the fields as shown in “What goes where in Claspine” below.
Click Save & test. Claspine writes one tiny test file into your bucket, reads it back and deletes it. A green result means everything is connected.

Permissions for the Claspine storage user: add, read and delete files in your project’s folder only. It cannot list the bucket or reach any other bucket.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::<bucket>/projects/<project-id>/*"
    }
  ]
}

What goes where in Claspine

Console field	Value
ENDPOINT	https://s3.<region>.amazonaws.com, using your bucket’s region.
BUCKET	The bucket name from step 1.
REGION	The bucket’s region, e.g. eu-central-1.
ACCESS KEY ID / SECRET	The pair from step 5.

Keep it safe

Never use your root AWS keys. If this key leaks, it can only reach your project’s folder in this one bucket.
Keep public access blocked. Claspine’s signed links expire after a few minutes.

Claspine stores the values encrypted, never shows them again in full, and never sends them to your app or SDK.

If something goes wrong

The test passes but uploads from your app fail in the browser.: The CORS rule is missing or does not include your app’s exact web address (including https://).
“Access denied” during the test.: Check the bucket name and project ID in the policy, and that the region in Claspine matches the bucket.

Provider documentation

AWS: configuring CORS

← All setup guides