We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
  • Be very careful about pushing anything that might have your S3 credentials. http://www.devfactor.net/2014/12/30/2375-amazon-mistake/
      Studying MODX in the desert - http://sottwell.com
      Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
      Join the Slack Community - http://modx.org
    • Some more details on this for casual or new S3 users.

      1. When you first create that 1-year free S3 account, you get an access key and a secret key. These are GLOBAL KEYS!!!. They give access to all AWS services. So if somebody gets their hands on them, they can create all kinds of accounts and services on your account.

      2. Go to the Security Credential section of your account. Create a group. The second step will be to select the policy for the group (sounds kind of familiar somehow...). For our case, scroll down and select Amazon S3 Full Access. These are basic default policies, you can create custom policies to limit a user to a single S3 bucket if you want to.

      3. Create a user, get him his own access key and secret key, and assign him to your group. This user will be strictly for accessing your S3 account via the API. You can give him a regular Amazon login if you want to, and he'll only be able to access your S3 service (or whatever you specified in the group Policy).

      4. Go delete those dangerous global keys. They have nothing to do with your Amazon login; you can always create more users and keys if you need them for other services.
        Studying MODX in the desert - http://sottwell.com
        Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
        Join the Slack Community - http://modx.org