Getting started with Amazon S3

To sign up for Amazon Web Services

1. Open http://www.amazonaws.cn/ and choose Sign Up.

2. Follow the on-screen instructions.

1. Sign in to the Amazon Web Services Management Console and open the Amazon S3 console at https://console.amazonaws.cn/s3/.

2. In the navigation bar on the top of the page, choose the name of the currently displayed Amazon Web Services Region. Next, choose the Region in which you want to create a bucket.

   Note

   • After you create a bucket, you can't change its Region.

   • To minimize latency and costs and address regulatory requirements, choose a Region close to you. Objects stored in a Region never leave that Region unless you explicitly transfer them to another Region. For a list of Amazon S3 Amazon Web Services Regions, see Amazon Web Services service endpoints in the Amazon Web Services General Reference.

3. In the left navigation pane, choose General purpose buckets.

4. Choose Create bucket. The Create bucket page opens.

5. For Bucket name, enter a name for your bucket.

   The bucket name must:

   • Be unique within a partition. A partition is a grouping of Regions. Amazon currently has three partitions: aws (commercial Regions), aws-cn (China Regions), and aws-us-gov (Amazon GovCloud (US) Regions).

   • Be between 3 and 63 characters long.

   • Consist only of lowercase letters, numbers, periods (.), and hyphens (-). For best compatibility, we recommend that you avoid using periods (.) in bucket names, except for buckets that are used only for static website hosting.

   • Begin and end with a letter or number.

   • For a complete list of bucket-naming rules, see General purpose bucket naming rules.

   Important

   • After you create the bucket, you can't change its name.

   • Don't include sensitive information in the bucket name. The bucket name is visible in the URLs that point to the objects in the bucket.

6. (Optional) Under General configuration, you can choose to copy an existing bucket's settings to your new bucket. If you don't want to copy the settings of an existing bucket, skip to the next step.

   Note

   This option:

   • Isn't available in the Amazon CLI and is only available in the Amazon S3 console

   • Doesn't copy the bucket policy from the existing bucket to the new bucket

   To copy an existing bucket's settings, under Copy settings from existing bucket, select Choose bucket. The Choose bucket window opens. Find the bucket with the settings that you want to copy, and select Choose bucket. The Choose bucket window closes, and the Create bucket window reopens.

   Under Copy settings from existing bucket, you now see the name of the bucket that you selected. The settings of your new bucket now match the settings of the bucket that you selected. If you want to remove the copied settings, choose Restore defaults. Review the remaining bucket settings on the Create bucket page. If you don't want to make any changes, you can skip to the final step.

7. Under Object Ownership, to disable or enable ACLs and control ownership of objects uploaded in your bucket, choose one of the following settings:

   ACLs disabled

   • Bucket owner enforced (default) – ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the general purpose bucket. ACLs no longer affect access permissions to data in the S3 general purpose bucket. The bucket uses policies exclusively to define access control.

     By default, ACLs are disabled. A majority of modern use cases in Amazon S3 no longer require the use of ACLs. We recommend that you keep ACLs disabled, except in unusual circumstances where you must control access for each object individually. For more information, see Controlling ownership of objects and disabling ACLs for your bucket.

   ACLs enabled

   • Bucket owner preferred – The bucket owner owns and has full control over new objects that other accounts write to the bucket with the bucket-owner-full-control canned ACL.

     If you apply the Bucket owner preferred setting, to require all Amazon S3 uploads to include the bucket-owner-full-control canned ACL, you can add a bucket policy that allows only object uploads that use this ACL.

   • Object writer – The Amazon Web Services account that uploads an object owns the object, has full control over it, and can grant other users access to it through ACLs.

   Note

   The default setting is Bucket owner enforced. To apply the default setting and keep ACLs disabled, only the s3:CreateBucket permission is needed. To enable ACLs, you must have the s3:PutBucketOwnershipControls permission.

8. Under Block Public Access settings for this bucket, choose the Block Public Access settings that you want to apply to the bucket.

   By default, all four Block Public Access settings are enabled. We recommend that you keep all settings enabled, unless you know that you need to turn off one or more of them for your specific use case. For more information about blocking public access, see Blocking public access to your Amazon S3 storage.

   Note

   To enable all Block Public Access settings, only the s3:CreateBucket permission is required. To turn off any Block Public Access settings, you must have the s3:PutBucketPublicAccessBlock permission.

9. (Optional) By default, Bucket Versioning is disabled. Versioning is a means of keeping multiple variants of an object in the same bucket. You can use versioning to preserve, retrieve, and restore every version of every object stored in your bucket. With versioning, you can recover more easily from both unintended user actions and application failures. For more information about versioning, see Retaining multiple versions of objects with S3 Versioning.

   To enable versioning on your bucket, choose Enable.

10. (Optional) Under Tags, you can choose to add tags to your bucket. With Amazon cost allocation, you can use bucket tags to annotate billing for your use of a bucket. A tag is a key-value pair that represents a label that you assign to a bucket. For more information, see Using cost allocation S3 bucket tags.

    To add a bucket tag, enter a Key and optionally a Value and choose Add Tag.

11. To configure Default encryption, under Encryption type, choose one of the following:

    • Server-side encryption with Amazon S3 managed keys (SSE-S3)

    • Server-side encryption with Amazon Key Management Service keys (SSE-KMS)

    • Dual-layer server-side encryption with Amazon Key Management Service (Amazon KMS) keys (DSSE-KMS)

      Important

      If you use the SSE-KMS or DSSE-KMS option for your default encryption configuration, you are subject to the requests per second (RPS) quota of Amazon KMS. For more information about Amazon KMS quotas and how to request a quota increase, see Quotas in the Amazon Key Management Service Developer Guide.

    Buckets and new objects are encrypted by using server-side encryption with Amazon S3 managed keys (SSE-S3) as the base level of encryption configuration. For more information about default encryption, see Setting default server-side encryption behavior for Amazon S3 buckets. For more information about SSE-S3, see Using server-side encryption with Amazon S3 managed keys (SSE-S3).

    For more information about using server-side encryption to encrypt your data, see Protecting data with encryption.

12. If you chose Server-side encryption with Amazon S3 managed keys (SSE-S3) or Dual-layer server-side encryption with Amazon Key Management Service (Amazon KMS) keys (DSSE-KMS), do the following:

    1. Under Amazon KMS key, specify your KMS key in one of the following ways:

       • To choose from a list of available KMS keys, choose Choose from your Amazon KMS keys, and choose your KMS key from the list of available keys.

         Both the Amazon managed key (aws/s3) and your customer managed keys appear in this list. For more information about customer managed keys, see Customer keys and Amazon keys in the Amazon Key Management Service Developer Guide.

       • To enter the KMS key ARN, choose Enter Amazon KMS key ARN, and enter your KMS key ARN in the field that appears.

       • To create a new customer managed key in the Amazon KMS console, choose Create a KMS key.

         For more information about creating an Amazon KMS key, see Creating keys in the Amazon Key Management Service Developer Guide.

       Important

       You can use only KMS keys that are available in the same Amazon Web Services Region as the bucket. The Amazon S3 console lists only the first 100 KMS keys in the same Region as the bucket. To use a KMS key that isn't listed, you must enter your KMS key ARN. If you want to use a KMS key that's owned by a different account, you must first have permission to use the key, and then you must enter the KMS key ARN. For more information about cross account permissions for KMS keys, see Creating KMS keys that other accounts can use in the Amazon Key Management Service Developer Guide. For more information about SSE-KMS, see Specifying server-side encryption with Amazon KMS (SSE-KMS). For more information about DSSE-KMS, see Using dual-layer server-side encryption with Amazon KMS keys (DSSE-KMS).

       When you use an Amazon KMS key for server-side encryption in Amazon S3, you must choose a symmetric encryption KMS key. Amazon S3 supports only symmetric encryption KMS keys and not asymmetric KMS keys. For more information, see Identifying symmetric and asymmetric KMS keys in the Amazon Key Management Service Developer Guide.

    2. When you configure your bucket to use default encryption with SSE-KMS, you can also use S3 Bucket Keys. S3 Bucket Keys lower the cost of encryption by decreasing request traffic from Amazon S3 to Amazon KMS. For more information, see Reducing the cost of SSE-KMS with Amazon S3 Bucket Keys. S3 Bucket Keys aren't supported for DSSE-KMS.

       By default, S3 Bucket Keys are enabled in the Amazon S3 console. We recommend leaving S3 Bucket Keys enabled to lower your costs. To disable S3 Bucket Keys for your bucket, under Bucket Key, choose Disable.

13. (Optional) S3 Object Lock helps protect new objects from being deleted or overwritten. For more information, see Locking objects with Object Lock. If you want to enable S3 Object Lock, do the following:

    1. Choose Advanced settings.

       Important

       Enabling Object Lock automatically enables versioning for the bucket. After you've enabled and successfully created the bucket, you must also configure the Object Lock default retention and legal hold settings on the bucket's Properties tab.

    2. If you want to enable Object Lock, choose Enable, read the warning that appears, and acknowledge it.

    Note

    To create an Object Lock enabled bucket, you must have the following permissions: s3:CreateBucket, s3:PutBucketVersioning, and s3:PutBucketObjectLockConfiguration.

14. Choose Create bucket.

To upload an object to a bucket

1. Open the Amazon S3 console at https://console.amazonaws.cn/s3/.

2. In the Buckets list, choose the name of the bucket that you want to upload your object to.

3. On the Objects tab for your bucket, choose Upload.

4. Under Files and folders, choose Add files.

5. Choose a file to upload, and then choose Open.

6. Choose Upload.

To download an object from an S3 bucket

1. Sign in to the Amazon Web Services Management Console and open the Amazon S3 console at https://console.amazonaws.cn/s3/.

2. In the left navigation pane, choose General purpose buckets or Directory buckets.

3. In the buckets list, choose the name of the bucket that you want to download an object from.

4. You can download an object from an S3 bucket in any of the following ways:

   • Select the check box next to the object, and choose Download. If you want to download the object to a specific folder, on the Actions menu, choose Download as.

   • If you want to download a specific version of the object, turn on Show versions (located next to the search box). Select the check box next to the version of the object that you want, and choose Download. If you want to download the object to a specific folder, on the Actions menu, choose Download as.

To copy an object to a folder

1. In the Buckets list, choose your bucket name.

2. Choose Create folder and configure a new folder:

   1. Enter a folder name (for example, favorite-pics).

   2. For the folder encryption setting, choose Disable.

   3. Choose Save.

3. Navigate to the Amazon S3 bucket or folder that contains the objects that you want to copy.

4. Select the check box to the left of the names of the objects that you want to copy.

5. Choose Actions and choose Copy from the list of options that appears.

   Alternatively, choose Copy from the options in the upper right.

6. Choose the destination folder:

   1. Choose Browse S3.

   2. Choose the option button to the left of the folder name.

      To navigate into a folder and choose a subfolder as your destination, choose the folder name.

   3. Choose Choose destination.

   The path to your destination folder appears in the Destination box. In Destination, you can alternately enter your destination path, for example, s3://bucket-name/folder-name/.

7. In the bottom right, choose Copy.

   Amazon S3 copies your objects to the destination folder.

1. In the Buckets list, choose the name of the bucket that you want to delete an object from.

2. Select the object that you want to delete.

3. Choose Delete from the options in the upper right.

4. On the Delete objects page, type delete to confirm deletion of your objects.

5. Choose Delete objects.

To empty a bucket

1. In the Buckets list, select the bucket that you want to empty, and then choose Empty.

2. To confirm that you want to empty the bucket and delete all the objects in it, in Empty bucket, type permanently delete.

   Important

   Emptying the bucket cannot be undone. Objects added to the bucket while the empty bucket action is in progress will be deleted.

3. To empty the bucket and delete all the objects in it, and choose Empty.

   An Empty bucket: Status page opens that you can use to review a summary of failed and successful object deletions.

4. To return to your bucket list, choose Exit.

After you empty your bucket or delete all the objects from your bucket, you can delete your bucket.

1. To delete a bucket, in the Buckets list, select the bucket.

2. Choose Delete.

3. To confirm deletion, in Delete bucket, type the name of the bucket.

   Important

   Deleting a bucket cannot be undone. Bucket names are unique. If you delete your bucket, another Amazon user can use the name. If you want to continue to use the same bucket name, don't delete your bucket. Instead, empty and keep the bucket.

4. To delete your bucket, choose Delete bucket.