# Connect Amazon S3 to WordPress

To move your WordPress media library to Amazon S3, install Offloft, create a bucket and an IAM user that can reach only that bucket, then let visitors read the files. Offloft tests the connection and public delivery before it serves anything from the cloud.

## 1. Create the bucket

Open the S3 console, choose **General purpose buckets** and select **Create bucket**.

**Region:** pick the one closest to most of your visitors and enter the same region in Offloft. *It cannot be changed later.*

**Name:** 3 to 63 lowercase letters, numbers and hyphens. Avoid periods: they break secure (https) addresses.

Leave **Object Ownership** on **Bucket owner enforced** and leave **Block Public Access** on for now; the public access step explains when to change it.

Bucket name:

```
my-site-media
```

## 2. Create a user with access to this bucket only

In the IAM console, go to **Policies > Create policy**, choose **JSON** and paste the policy below. It allows exactly what Offloft does, on "my-site-media" only. Name it, for example, offloft-my-site-media.

Go to **Users > Create user**. Give it a name, choose **Attach policies directly**, pick the policy you just made and create the user.

Open the user, go to the **Security credentials** tab and select **Create access key**. Choose **Other**, then **Next**, then **Create access key**.

Copy the **Access key** and the **Secret access key** into Offloft (select **Show**, or **Download .csv file**). *AWS shows the secret only once.*

IAM policy:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "OffloftListBucket",
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::my-site-media"]
    },
    {
      "Sid": "OffloftManageFiles",
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:AbortMultipartUpload"],
      "Resource": ["arn:aws:s3:::my-site-media/*"]
    }
  ]
}
```

## 3. Let visitors read the files

New buckets block all public access, so visitors cannot see your images yet. Make the files readable here.

Open the bucket, go to **Permissions > Block public access (bucket settings)**, select **Edit**, clear **Block all public access** and save. If it still fails, the same setting at account level (**Block Public Access settings for this account**) is on.

Then, under **Bucket policy**, select **Edit** and paste the policy below. It lets anyone read a file whose address they know; nobody can list, change or delete files.

Offloft does not need object ACLs; keep **Bucket owner enforced**.

Bucket policy:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::my-site-media/*"]
    }
  ]
}
```

## 4. Allow your site to read files (CORS) (optional)

This step is optional. Images on your pages load without it. You need it only when your site's own scripts read files from storage, for example image editors, web fonts or 3D viewers. The rule below lets only your site read files, and only read them.

Open the bucket, go to **Permissions > Cross-origin resource sharing (CORS)**, select **Edit** and paste the rule.

CORS configuration:

```json
[
  {
    "AllowedOrigins": ["https://yoursite.com"],
    "AllowedMethods": ["GET", "HEAD"],
    "AllowedHeaders": ["*"],
    "MaxAgeSeconds": 3600
  }
]
```

## Permissions Offloft needs

An IAM policy that allows s3:ListBucket on the bucket, and s3:PutObject, s3:GetObject, s3:DeleteObject and s3:AbortMultipartUpload on its files. The exact policy is in step 2.

## Serving your files

New buckets block all public access, so visitors can't see files until you allow it. Turn off Block Public Access for this bucket and add the bucket policy from step 3. It lets anyone read a file whose address they know; nobody can list, change or delete files. The delivery check confirms it works.

## Questions

### Can I change the region later?

No. A bucket's region can't be changed, so pick the one closest to most of your visitors and enter the same region in Offloft.

### Should I use periods in the bucket name?

No. Periods break secure (https) addresses. Use lowercase letters, numbers and hyphens.

### Do I need object ACLs?

No. Offloft does not need them, so keep Object Ownership on Bucket owner enforced.

### Does anyone get to list my files?

No. The bucket policy lets someone read a file whose address they know. Nobody can list, change or delete files.

Source: https://www.offloft.com/setup/amazon-s3