Step 1Create an AWS account

Create an AWS account at portal.aws.amazon.com/billing/signup. You need permission to create S3 buckets and IAM users. If your business already has AWS, ask whoever runs it for that access.

AWS bills you directly for storage; Dropbucket doesn't charge for it. Prices change, so check AWS's pricing page for current rates.

Still choosing a provider? We recommend iDrive e2. See how to set up iDrive e2.

Step 2Create a private bucket and pick a region

  1. Open the S3 console and choose Create bucket.
  2. Pick an AWS Region close to you and your clients, for example ap-southeast-2 (Sydney). Note it.
  3. Enter a bucket name using lowercase letters, numbers and dashes, for example agency-transfers. Avoid dots: they cause certificate errors with the default URL style.
  4. Leave Block all public access turned on. Dropbucket uses short-lived signed links, so the bucket stays private.
  5. Leave the other settings at their defaults and choose Create bucket.

Step 3Create an access key for that bucket only

Dropbucket needs to read, write and delete objects, run multipart uploads and (optionally) set the bucket's CORS rule. Nothing else, and only on this bucket.

Create the policy

  1. Open the IAM console and go to Policies → Create policy.
  2. Switch the editor to JSON and paste the policy below. Replace agency-transfers with your bucket name in both places.
  3. Name it dropbucket-agency-transfers and create it.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DropbucketBucket",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketCORS",
        "s3:PutBucketCORS"
      ],
      "Resource": "arn:aws:s3:::agency-transfers"
    },
    {
      "Sid": "DropbucketObjects",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:AbortMultipartUpload",
        "s3:ListMultipartUploadParts"
      ],
      "Resource": "arn:aws:s3:::agency-transfers/*"
    }
  ]
}
  • s3:PutObject covers normal uploads and each stage of a multipart upload.
  • s3:ListMultipartUploadParts lets an interrupted upload resume from the parts already in the bucket.
  • s3:AbortMultipartUpload cleans up a cancelled upload so you're not billed for leftover parts.
  • s3:ListBucket lets S3 answer "not found" properly instead of "access denied" when a file is missing.
  • s3:GetBucketCORS and s3:PutBucketCORS let Dropbucket add its browser-upload rule for you. Remove them if you'd rather paste the rule yourself in Step 6.

Create the user and access key

  1. In IAM, go to Users → Create user. Name it dropbucket and don't give it console access.
  2. On the permissions step, choose Attach policies directly and tick the policy you just made.
  3. Create the user, open it, go to the Security credentials tab and choose Create access key.
  4. For the use case, pick Third-party service (or Application running outside AWS). Confirm and create.

AWS shows an Access key and a Secret access key. Copy both, or download the .csv file. The secret is shown once only.

The exact menus may differ slightly as AWS updates its console.

Step 4Find your endpoint and region

S3 endpoints follow your region:

https://s3.<REGION>.amazonaws.com

For Sydney that's https://s3.ap-southeast-2.amazonaws.com, and the region code is ap-southeast-2. The bucket's region is shown in the S3 console's bucket list.

Step 5Enter the details in Dropbucket

  1. In Dropbucket, go to Settings → Storage.
  2. Provider: choose Amazon S3. Dropbucket fills in the endpoint https://s3.<REGION>.amazonaws.com and region us-east-1 for you.
  3. Endpoint: replace <REGION> with your region, for example https://s3.ap-southeast-2.amazonaws.com.
  4. Bucket: the bucket name from Step 2.
  5. Region: the same region code, for example ap-southeast-2. Dropbucket fills in us-east-1 by default.
  6. Access key ID and Secret access key: the Access key and Secret access key from Step 3.
  7. Folder inside the bucket (optional): leave it blank, or enter a folder such as client-files if the bucket holds other things too.
  8. Path-style URLs: leave it unticked. That's the right setting for Amazon S3.

Read Step 6 before you press Test and save. Your keys are encrypted before they're stored, and Dropbucket only uses them to sign uploads and downloads. Files never pass through Dropbucket's servers.

Step 6Add the CORS rule

Files travel from your client's browser straight into your bucket. The browser only allows that if the bucket says Dropbucket's pages may upload to it. That permission is a CORS rule.

The Storage page in Dropbucket shows the exact rule under CORS rule, and tries to apply it for you when you save.

With the policy from Step 3, Dropbucket adds the rule itself when you press Test and save. If you removed the two CORS actions, add it by hand:

  1. In the S3 console, open the bucket and go to the Permissions tab.
  2. Under Cross-origin resource sharing (CORS), choose Edit.
  3. Paste the rule below and save.
[
  {
    "AllowedOrigins": [
      "https://app.dropbucket.io"
    ],
    "AllowedMethods": [
      "GET",
      "PUT",
      "HEAD"
    ],
    "AllowedHeaders": [
      "*"
    ],
    "ExposeHeaders": [
      "ETag"
    ],
    "MaxAgeSeconds": 3600
  }
]

Using your own domain for download and upload pages? Add it as a second origin, for example "https://files.youragency.com", with a comma after the first. No trailing slash. The Storage page in Dropbucket shows the rule with your verified domains already filled in, so copying it from there is safest. See Put your download pages on your own domain.

Keep ETag in ExposeHeaders. Dropbucket reads it after every chunk of a large upload, and uploads stop without it.

Step 7Run the connection check

  1. Press Test and save.
  2. Dropbucket writes a tiny test file to the bucket, reads it back and deletes it. When that works, the Status card shows a tick next to Keys work.
  3. It then tries to add the CORS rule and runs a real test upload from your browser. When that works, Browser uploads allowed (CORS) shows a tick.

With the full policy, both steps should tick on their own. If you see "We couldn't set this automatically on your provider", paste the rule as in Step 6, then press Check again.

Two ticks means you're connected. Send a small test transfer to yourself to see the whole thing working.

Step 8Fix common errors

The messages below are exactly what Dropbucket shows on the Storage page.

Permissions

“The storage provider refused these keys. Check the access key, secret and bucket permissions.”Check the key and secret were copied in full. Check the policy is attached to the user and the bucket name in both Resource lines is right. The bucket line has no /*; the objects line does.

“Wrote a test file but could not read it back”The key can write but not read. Give it read and write access to the bucket, then press Test and save again.

Keys work, but uploads fail with a 403 errorUsually CORS. If CORS passes and the bucket uses a KMS key for encryption (SSE-KMS), the IAM user also needs kms:GenerateDataKey and kms:Decrypt on that key. Default encryption (SSE-S3) needs nothing extra.

Region and endpoint

“That bucket was not found at this endpoint.”Check the spelling of the bucket name.

“Wrong region or endpoint for this bucket.”The endpoint or Region doesn't match the bucket's region. S3 redirects requests sent to the wrong region, and Dropbucket reports that as this error.

“We couldn't reach your storage with these settings. Check the endpoint and region.”The endpoint has a typo or the region code is wrong. Copy the endpoint again from your provider's console.

“Endpoint should be just the address, with no path”Remove everything after the domain, including any bucket name. The endpoint must also start with https://.

“Custom S3 endpoints come with a lifetime plan. Pick one of the listed providers, or upgrade.”On the free plan the endpoint has to be one of the listed providers' own addresses. This usually means a typo in the domain part of the endpoint.

Certificate or connection errors with a dotted bucket nameNames like files.agency.com break the default URL style over HTTPS. Use a bucket name without dots, or tick Path-style URLs.

CORS

Keys work, but Browser uploads allowed (CORS) doesn't tickThe CORS rule is missing, was saved on a different bucket, or has a typo in the origin. The origin must be exactly https://app.dropbucket.io, with no slash at the end. Fix it, wait a minute, then press Check again.

“Your storage didn't return an ETag. Check its CORS settings (expose ETag).”Your CORS rule is missing ETag under ExposeHeaders. Add it back and save the rule.

Still stuck? Email support@dropbucket.io with the message you see. Never send us your secret key.