Amazon S3 Setup Documentation

The Amazon S3 feature for Easy Digital Downloads (EDD) lets you host your download files in your Amazon S3 account. It’s more secure and reliable than storing files directly on your own hosting account.

This guide walks you through creating an IAM user in AWS, connecting your Amazon S3 account to EDD, and using Amazon S3 once everything is set up.

Note: Amazon S3 is a Pro feature that requires at least an Extended pass.

---

Enabling Amazon S3

To install the Amazon S3 feature in your EDD store, go to Downloads » Extensions, search for Amazon S3, and click Install.

See How Do I Install an Extension? for more on installing and activating features.

Once it’s active, you’ll find the Amazon S3 settings under Downloads » Settings » Extensions » Amazon S3. You’ll enter your AWS credentials there once you’ve completed the steps below.

Creating an IAM Account

To connect Easy Digital Downloads to your Amazon S3 account, you need to create an IAM user in AWS and attach a permissions policy to it.

Once that’s done, you’ll generate an access key and secret key for that user, then enter both under Downloads » Settings » Extensions » Amazon S3 in your WordPress site.

Log Into Your Amazon S3 Account

If you don’t already have an AWS account, create one at Amazon S3 before continuing.

Log into your Amazon S3 account and go to the Users page. You can find this page by clicking your account name in the top right corner, then Security Credentials » Users under Access Management on the left side of the page.

Set Up Your IAM User

If you already have an IAM user you want to use, select that user.

Add a User

If you need a new one, click the Create user button and follow the prompts. You’ll need to get security credentials and attach a permissions policy to the user.

Set User Details

Enter a user name of your choice and click Next.

Set Permissions

On the next screen, you’ll set the user permissions.

1. Select Attach policies directly.
2. In the Filter box, enter “S3full” to narrow the results to Amazon S3 policies.
3. Check the box for AmazonS3FullAccess.
4. Skip the “Set permissions boundary – optional” section.
5. Click Next.

Want tighter permissions instead of full account access? AmazonS3FullAccess grants access to every bucket and every S3 operation on your AWS account. See Limiting Access to Specific Buckets below for a policy scoped to just the bucket EDD uses.

Review and Create

Confirm your permissions match the steps above, then click Create user.

Getting Access Keys

You’ll need an IAM user set up with the permissions from the steps above. If you already have an IAM user with AmazonS3FullAccess permissions, you can use that one.

Go to the IAM user name you created, listed on your AWS Users page. Select the Security Credentials tab, followed by Create access key.

Select Third-party service and check Confirm.

On the next screen, select Create access key. You don’t need to add a description tag.

Save your Access key and Secret access key.

Your IAM user now has permission to access and upload files to the S3 bucket, giving your EDD store access to your files and the ability to create secure download links for customers.

Add your Access key and Secret access key to your EDD store’s Amazon S3 settings under Downloads » Settings » Extensions » Amazon S3.

If you need more help creating IAM users or attaching policies, see Amazon’s guide on creating IAM users.

Limit Access to Specific Buckets

If your S3 account is used for other purposes and you want to limit your IAM user (the one your EDD store uses) to specific buckets, create a custom policy instead of using AmazonS3FullAccess.

Select Attach policies directly, followed by Create policy.

Add the policy details below through the JSON editor. Replace bucket-name-here with the name of the bucket (or buckets) you want your EDD store to access.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObjectAcl",
                "s3:GetObject",
                "s3:ListBucketMultipartUploads",
                "s3:AbortMultipartUpload",
                "s3:ListBucket",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-name-here",
                "arn:aws:s3:::bucket-name-here/*"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "*"
        }
    ]
}

With this policy, all your bucket names are still visible, but only the buckets listed in the Resource section are accessible. If EDD tries to access a bucket that isn’t in the Resource list, you’ll see a PHP error.

Amazon S3 Setup

If you haven’t already, go to Downloads » Settings » Extensions » Amazon S3 to enter your Amazon S3 access and secret keys.

Enter a Default Bucket

On this screen, you’ll also enter other account info like your Amazon S3 Default Bucket.

This is the default bucket you want files uploaded to. To create new buckets or see a list of your current buckets, go to your S3 Console (you’ll need to log in to access it).

Create the bucket you want to use as the default. You can still choose a different bucket per file when uploading.

Set Bucket Permissions

Turn Block all public access ON for your bucket to restrict unauthorized access to files. EDD provides temporary access to files for customers, so the bucket itself doesn’t need to be public.

Enter an Amazon S3 Endpoint (Optional)

The Amazon S3 Endpoint is the endpoint your bucket uses.

You can usually leave this field blank. If your site has trouble accessing your bucket, try changing this to the endpoint for your bucket’s region.

Find your bucket’s region by logging into your Amazon S3 account, clicking S3, and checking the region column next to each bucket. Then find the matching endpoint on Amazon’s S3 Region Documentation.

Copy and paste that endpoint in the field, then save.

The Amazon S3 Endpoint field also works with Cloudflare R2 and other S3-compatible storage providers, not just AWS. If you’re using R2 or a similar service, enter its endpoint here the same way.

Link Validity Time (Optional)

The final setting field on the EDD Amazon S3 extensions screen is Link Validity Time. This is the number of minutes the dynamically generated download URL stays valid.

When a customer clicks a download link, EDD generates a new, temporary URL for the file on Amazon S3. This setting controls how long that URL works before it expires.

If you leave this field blank, the link stays valid for 5 minutes by default.

FES Folder Name (Optional)

If you’re using Frontend Submissions alongside Amazon S3, this setting controls how vendor files are organized in your S3 bucket. Choose whether files are stored in folders named after each vendor’s username or their user ID.

See Amazon S3 and Frontend Submissions for more on how the two features work together.

---

Using Amazon S3 With EDD

You upload files to a downloadable product the same way as before, but this feature gives you two new tabs in the media uploader: Upload to Amazon S3 and Amazon S3 Library.

Uploading to Amazon S3 via EDD

When you upload a file from the Upload to Amazon S3 tab, Easy Digital Downloads automatically uploads it to your Amazon S3 account.

Any file you upload this way is also accessible from your WordPress Media Library, just like any other media file.

Adding Files Already on AWS to EDD

Any file already on S3 is accessible from your WordPress Media Library through the Amazon S3 Library tab in the media uploader.

You can also add files to the File URL field manually.

Forcing Files to Download

Sometimes your browser tries to display or play a file instead of downloading it, like opening music or video directly in the browser. You can usually fix this with settings on your web server, but files stored on Amazon S3 ignore your web server’s settings entirely.

Instead, you need to configure this directly in S3.

Note: This setting applies to individual files or folders, not the whole bucket.

Opening File Properties

In your S3 bucket, find the file you want to work with, select it, and click Actions » Change metadata.

Click Add Metadata, set the Type to System defined, the Key to Content-Disposition, and the Value to attachment. Click Save changes.

This forces the file to download instead of playing or displaying in the browser.

---

Troubleshooting and FAQs