Setting up an AWS S3 bucket

Four things to make at AWS, in this order: a bucket, a policy that allows only that bucket, a user with that policy, and that user's keys. Then four fields in the app. Twenty minutes the first time.

1. Sign in at console.aws.amazon.com/s3 and tap Create bucket.
2. In the region menu at the top right pick the region closest to you, for example Europe (Milan) eu-south-1 or Europe (Frankfurt) eu-central-1. Write the code down; the app asks for it.
3. Bucket type: General purpose. Bucket namespace: Global namespace.
4. Bucket name: lower-case letters, digits and hyphens, unique in the world, for example my-name-photos. Write it down too.
5. Object Ownership: ACLs disabled. Block all public access: ticked, as it comes. Bucket Versioning: Disable. Leave encryption as it comes.
6. Tap Create bucket. The bucket is empty; the app fills it.

1. In the search box at the top type IAM and open it. In the left menu tap Policies, then Create policy.
2. Switch the editor from Visual to JSON, delete what is there, and paste this, with your bucket's name in place of my-name-photos, in both places:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": "arn:aws:s3:::my-name-photos"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::my-name-photos/*"
    }
  ]
}

3. If the editor shows a red mark, a line break got into the text while pasting: delete everything and paste again.
4. Tap Next, name the policy opensolr-photos, tap Create policy.

The policy lets its holder list that one bucket and write, read and delete files in it. It cannot see any other bucket or anything else in your AWS account.

1. In the left menu tap IAM users, then Create user.
2. User name: opensolr-photos. Leave Provide user access to the AWS Management Console unticked: this user never signs in anywhere. Tap Next.
3. Pick Attach policies directly. In the search box type opensolr-photos, tick the policy you just made, tap Next.
4. Check the summary: one user, one policy. Tap Create user.

1. Tap the user opensolr-photos in the list, then the Security credentials tab.
2. Under Access keys tap Create access key. Pick Application running outside AWS, tap Next, then Create access key.
3. You see an Access key and, after Show, a Secret access key. Copy both now: the secret is shown this one time. If you lose it, make a new key here and type the new one into the app.
4. Tap Done.

1. Me, Settings, Backup, Storage backend. Pick S3 bucket.
2. Name: anything, for example AWS. It is only how the app refers to this backend.
3. Endpoint: leave it empty. Empty means AWS, in the region you give.
4. Region: the code you wrote down, such as eu-south-1.
5. Bucket: the bucket's name.
6. Access key and Secret key: the two values from step 04.
7. Folder in the bucket: leave it empty, or give a folder name if you keep other things in the same bucket.
8. Pick Originals or 1080p, tap Test connection, then Save and start backup. See Test connection, Save.

Roughly what it costs at AWS: storage by the gigabyte per month, a small one-time amount for the uploads, and download traffic only when files come back to a phone. See what it costs.