AWS S3
The values and permissions this package needs on AWS, with links to AWS's own guides.
AWS documents how to create buckets, keys and policies, and its pages are the source of truth. This page only says what this package needs. What the bucket and the keys must allow is on Storage.
AWS's guides
| Task | AWS's page |
|---|---|
| S3 in general | What is Amazon S3? |
| Create a bucket | Creating a general purpose bucket |
| Allow public reads, or keep it private | Blocking public access and bucket policy examples |
| Make the write key and the read key | Manage access keys for IAM users |
| Path-style URLs | Virtual hosting of buckets |
| Conditional writes | How to prevent object overwrites with conditional writes |
What this package needs
- The write key: an IAM user limited to the one bucket, with
s3:GetObject,s3:PutObjectands3:DeleteObjecton its objects ands3:ListBucketon the bucket. - A public bucket: anonymous
s3:GetObjecton the bucket's objects, and Block Public Access turned off far enough for that bucket policy to apply. - A private bucket: a second IAM user with only
s3:GetObjectands3:ListBucketon the bucket. This key ends up inside the app. - Conditional PUT: supported. AWS's page says to "add the HTTP
If-None-MatchorIf-Matchheader" to a write, and that a mismatch fails with412 Precondition Failed.
Settings
The package uses path-style URLs: https://s3.<region>.amazonaws.com/<bucket>. AWS still serves
them in every region, but has said it plans to end them one day; see its virtual hosting page.
Publish settings, from CI secrets or .env.local:
PREVIEW_S3_URL=https://s3.<region>.amazonaws.com/<bucket>
PREVIEW_S3_ACCESS_KEY_ID=<write key id>
PREVIEW_S3_SECRET_ACCESS_KEY=<write key secret>
PREVIEW_S3_REGION=<region>Set PREVIEW_S3_REGION to the bucket's region. The default, us-east-1, is only right for buckets
there.
The app, public bucket:
EXPO_PUBLIC_PREVIEW_S3_URL=https://s3.<region>.amazonaws.com/<bucket>The app, private bucket:
EXPO_PUBLIC_PREVIEW_S3_URL=https://s3.<region>.amazonaws.com/<bucket>
EXPO_PUBLIC_PREVIEW_S3_READ_ACCESS_KEY_ID=<read key id>
EXPO_PUBLIC_PREVIEW_S3_READ_SECRET_ACCESS_KEY=<read key secret>
EXPO_PUBLIC_PREVIEW_S3_REGION=<region>A CDN in front of a public bucket works too: put its address in the app's URL, and keep publishing to the bucket's own URL.
Then run a test publish.
Next: Cloudflare R2