# Amazon S3 Setup Documentation The [Amazon S3 feature](https://easydigitaldownloads.com/downloads/amazon-s3/) for Easy Digital Downloads (EDD) lets you host your download files in your Amazon S3 account. It's more secure and reliable than storing files directly on your own hosting account. This guide walks you through creating an IAM user in AWS, connecting your Amazon S3 account to EDD, and using Amazon S3 once everything is set up. **Note:** Amazon S3 is a Pro feature that requires at least an Extended pass. - [Enabling Amazon S3](#enabling-amazon-s3) - [Creating an IAM Account](#creating-iam-account) - [Log Into Your Amazon S3 Account](#log-into-your-amazon-s3-account) - [Set Up Your IAM User](#set-up-your-iam-user) - [Add a User](#add-a-user) - [Set User Details](#set-user-details) - [Set Permissions](#set-permissions) - [Review and Create](#review-and-create) - [Getting Access Keys](#getting-access-keys) - [Limit Access to Specific Buckets](#limit-access) - [Amazon S3 Setup](#setup) - [Enter a Default Bucket](#enter-a-default-bucket) - [Set Bucket Permissions](#set-bucket-permissions) - [Enter an Amazon S3 Endpoint (Optional)](#enter-amazon-s3-endpoint) - [Link Validity Time (Optional)](#link-validity-time-optional) - [FES Folder Name (Optional)](#fes-folder-name-optional) - [Using Amazon S3 With EDD](#edd) - [Uploading to Amazon S3 via EDD](#uploading-to-amazon-s3-via-edd) - [Adding Files Already on AWS to EDD](#adding-files-already-on-aws-to-edd) - [Using Amazon S3 With CFM](#using-amazon-s3-with-cfm) - [Forcing Files to Download](#forcing-files-to-download) - [Opening File Properties](#opening-file-properties) - [Troubleshooting and FAQs](#troubleshooting-and-faqs) --- Enabling Amazon S3 ------------------ To install the Amazon S3 feature in your EDD store, go to **Downloads** » **Extensions**, search for **Amazon S3**, and click **Install**. ![Enabling Amazon S3 for EDD.](https://easydigitaldownloads.com/wp-content/uploads/2022/01/image-800x399.png)See [How Do I Install an Extension?](https://easydigitaldownloads.com/docs/how-do-i-install-an-extension/) for more on installing and activating features. Once it's active, you'll find the Amazon S3 settings under **Downloads** » **Settings** » **Extensions** » **Amazon S3**. You'll enter your AWS credentials there once you've completed the steps below. Creating an IAM Account ----------------------- To connect Easy Digital Downloads to your Amazon S3 account, you need to create an IAM user in AWS and attach a permissions policy to it. Once that's done, you'll generate an access key and secret key for that user, then enter both under **Downloads** » **Settings** » **Extensions** » **Amazon S3** in your WordPress site. ### Log Into Your Amazon S3 Account If you don't already have an AWS account, create one at [Amazon S3](https://aws.amazon.com/s3/) before continuing. Log into your Amazon S3 account and go to the [Users page](https://console.aws.amazon.com/iam/home#users). You can find this page by clicking your account name in the top right corner, then **Security Credentials** » **Users** under **Access Management** on the left side of the page. ### Set Up Your IAM User If you already have an IAM user you want to use, select that user. #### Add a User If you need a new one, click the **Create user** button and follow the prompts. You'll need to get security credentials and attach a permissions policy to the user. ![Creating an IAM user in AWS to connect Amazon S3 with Easy Digital Downloads.](https://easydigitaldownloads.com/wp-content/uploads/2022/01/aws-create-iam-user.jpg)#### Set User Details Enter a user name of your choice and click **Next**. ![Creating user details in Amazon S3 for EDD integration. ](https://easydigitaldownloads.com/wp-content/uploads/2022/01/create-iam-user-amazon-s3.jpg)#### Set Permissions On the next screen, you'll set the user permissions. 1. Select **Attach policies directly**. 2. In the **Filter** box, enter "S3full" to narrow the results to Amazon S3 policies. 3. Check the box for **AmazonS3FullAccess**. 4. Skip the "Set permissions boundary - optional" section. 5. Click **Next**. ![Setting AmazonS3Fullaccess permissions.](https://easydigitaldownloads.com/wp-content/uploads/2022/01/amazons3-set-permissions.jpg)**Want tighter permissions instead of full account access?** AmazonS3FullAccess grants access to every bucket and every S3 operation on your AWS account. See [Limiting Access to Specific Buckets](#limit-access) below for a policy scoped to just the bucket EDD uses. #### Review and Create Confirm your permissions match the steps above, then click **Create user**. ![The Review and create screen in AWS for IAM.](https://easydigitaldownloads.com/wp-content/uploads/2022/01/review-and-create-aws-user.png)Getting Access Keys ------------------- You'll need an IAM user set up with the permissions from the steps above. If you already have an IAM user with AmazonS3FullAccess permissions, you can use that one. Go to the IAM user name you created, listed on your AWS [Users page](https://console.aws.amazon.com/iam/home#users). Select the **Security Credentials** tab, followed by **Create access key**. ![The Create Access Key button under Security Credentials in Amazon S3 settings. ](https://easydigitaldownloads.com/wp-content/uploads/2022/01/iam-aws-create-access-key.jpg)Select **Third-party service** and check **Confirm**. ![Creating an AWS access key as IAM user with third-party service.](https://easydigitaldownloads.com/wp-content/uploads/2022/01/access-key-third-party-service-aws.jpg)On the next screen, select **Create access key**. You don't need to add a description tag. ![The final screen to create access key in Amazon S3 for Easy Digital Downloads integration.](https://easydigitaldownloads.com/wp-content/uploads/2022/01/create-access-key-amazons3.png)Save your **Access key** and **Secret access key**. ![The Amazon S3 screen for IAM users to retrieve access keys. ](https://easydigitaldownloads.com/wp-content/uploads/2022/01/retrieve-aws-access-keys.png)**Note:** You won't be able to access the secret key again for this user, so make sure you save it somewhere safe. If you lose the credentials, you'll need to create a new access key. Your IAM user should now have full permission to access and upload files to the S3 bucket. This provides your EDD store with access to your files and the ability to create secure download links for customers. Your IAM user now has permission to access and upload files to the S3 bucket, giving your EDD store access to your files and the ability to create secure download links for customers. Add your **Access key** and **Secret access key** to your EDD store's Amazon S3 settings under **Downloads** » **Settings** » **Extensions** » **Amazon S3**. ![The Amazon S3 feature settings tab im Easy Digital Downloads. ](https://easydigitaldownloads.com/wp-content/uploads/2022/01/amazon-s3-and-edd-settings.png)If you need more help creating IAM users or attaching policies, see [Amazon's guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html?icmpid=docs_iam_console) on creating IAM users. Limit Access to Specific Buckets -------------------------------- If your S3 account is used for other purposes and you want to limit your IAM user (the one your EDD store uses) to specific buckets, create a custom policy instead of using AmazonS3FullAccess. Select **Attach policies directly**, followed by **Create policy**. ![Create policy for user permissions in Amazon S3.](https://easydigitaldownloads.com/wp-content/uploads/2022/01/create-custom-policy-permissions-aws-800x297.png)Add the policy details below through the JSON editor. Replace `bucket-name-here` with the name of the bucket (or buckets) you want your EDD store to access. ``` `{ "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObjectAcl", "s3:GetObject", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:ListBucket", "s3:ListMultipartUploadParts" ], "Resource": [ "arn:aws:s3:::bucket-name-here", "arn:aws:s3:::bucket-name-here/*" ] }, { "Sid": "VisualEditor1", "Effect": "Allow", "Action": "s3:ListAllMyBuckets", "Resource": "*" } ]}` ``` With this policy, all your bucket names are still visible, but only the buckets listed in the **Resource** section are accessible. If EDD tries to access a bucket that isn't in the **Resource** list, you'll see a PHP error. Amazon S3 Setup --------------- If you haven't already, go to **Downloads** » **Settings** » **Extensions** » **Amazon S3** to enter your [Amazon S3 access and secret keys](#getting-access-keys). ![The form settings to enter Amazon S3 account info in Easy Digital Downloads.](https://easydigitaldownloads.com/wp-content/uploads/2022/01/edd-amazon-s3-settings.jpg)### Enter a Default Bucket On this screen, you'll also enter other account info like your **Amazon S3 Default Bucket**. ![Dropdown menu for he Amazon S3 Default Bucket in EDD.](https://easydigitaldownloads.com/wp-content/uploads/2022/01/amazon-s3-default-bucket-edd-800x107.png)This is the default bucket you want files uploaded to. To create new buckets or see a list of your current buckets, go to your [S3 Console](https://console.aws.amazon.com/s3/home) (you'll need to log in to access it). Create the bucket you want to use as the default. You can still choose a different bucket per file when uploading. ### Set Bucket Permissions Turn **Block all public access** ON for your bucket to restrict unauthorized access to files. EDD provides temporary access to files for customers, so the bucket itself doesn't need to be public. ![Creating default bucket in AWS.](https://easydigitaldownloads.com/wp-content/uploads/2022/01/default-bucket-public-access.jpg)### Enter an Amazon S3 Endpoint (Optional) The **Amazon S3 Endpoint** is the endpoint your bucket uses. You can usually leave this field blank. If your site has trouble accessing your bucket, try changing this to the endpoint for your bucket's region. Find your bucket's region by logging into your Amazon S3 account, clicking **S3**, and checking the region column next to each bucket. Then find the matching endpoint on [Amazon's S3 Region Documentation](https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region). ![Amazon S3 settings screen showing AWS Region column in default Buckets. ](https://easydigitaldownloads.com/wp-content/uploads/2022/01/bucketes-aws-regions.png)Copy and paste that endpoint in the field, then save. The **Amazon S3 Endpoint** field also works with Cloudflare R2 and other S3-compatible storage providers, not just AWS. If you're using R2 or a similar service, enter its endpoint here the same way. ### Link Validity Time (Optional) The final setting field on the EDD Amazon S3 extensions screen is **Link Validity Time**. This is the number of minutes the dynamically generated download URL stays valid. When a customer clicks a download link, EDD generates a new, temporary URL for the file on Amazon S3. This setting controls how long that URL works before it expires. If you leave this field blank, the link stays valid for 5 minutes by default. ### FES Folder Name (Optional) If you're using [Frontend Submissions](https://easydigitaldownloads.com/docs/frontend-submissions/) alongside Amazon S3, this setting controls how vendor files are organized in your S3 bucket. Choose whether files are stored in folders named after each vendor's username or their user ID. See [Amazon S3 and Frontend Submissions](https://easydigitaldownloads.com/docs/amazon-s3-and-frontend-submissions/) for more on how the two features work together. --- Using Amazon S3 With EDD ------------------------ You upload files to a downloadable product the same way as before, but this feature gives you two new tabs in the media uploader: **Upload to Amazon S3** and **Amazon S3 Library**. ![Upload to Amazon S3 from Easy Digital Downloads. ](https://easydigitaldownloads.com/wp-content/uploads/2022/01/upload-files-from-edd-to-amazons3-800x372.png)### Uploading to Amazon S3 via EDD When you upload a file from the **Upload to Amazon S3** tab, Easy Digital Downloads automatically uploads it to your Amazon S3 account. Any file you upload this way is also accessible from your WordPress Media Library, just like any other media file. ![Uploading to Amazon S3 from Easy Digital Downloads plugin.](https://easydigitaldownloads.com/wp-content/uploads/2022/07/6184ccf6a9f3b.gif)### Adding Files Already on AWS to EDD Any file already on S3 is accessible from your WordPress Media Library through the **Amazon S3 Library** tab in the media uploader. ![The Amazon S3 library in Easy Digital Downloads' Media Library.](https://easydigitaldownloads.com/wp-content/uploads/2022/01/amazon-s3-library-edd.png)You can also add files to the File URL field manually. ![Manually adding files in EDD for Amazon S3 buckets.](https://easydigitaldownloads.com/wp-content/uploads/2022/07/6184ccf7b206a.png)The field accepts a few different formats: - **Media uploader format:** `bucket-name/filename.zip` - **Virtual-hosted-style URLs:** for example, `https://bucket-name.s3.amazonaws.com/filename.zip` - **Path-style URLs:** for example, `https://s3.amazonaws.com/bucket-name/filename.zip` - **Regional endpoint URLs:** for example, `https://bucket-name.s3.region-code.amazonaws.com/filename.zip` **Important** ⚠️ - Don't copy and paste the URL directly from your Amazon S3 library into the **File URL** field. That causes an Access Denied error when a customer tries to download the file. Use one of the formats above instead. - All bucket and folder names in your Amazon S3 account must be lowercase and free of special characters. See Amazon's documentation on [bucket naming restrictions](https://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html). - Not all versions of S3 are available in every region. [This chart shows which are available in your region.](https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region) - Files delivered through Amazon S3 always [deliver as Redirect](https://easydigitaldownloads.com/docs/what-is-the-difference-between-forced-download-and-redirect-download/), even if your store is set to Forced. Using Amazon S3 With CFM ------------------------ If you use [Checkout Fields Manager](https://easydigitaldownloads.com/docs/checkout-fields-manager/) alongside Amazon S3, files customers upload through CFM forms at checkout are automatically sent to your Amazon S3 bucket and stored in a `cfm/` folder. You don't need to configure anything extra. Once your Amazon S3 credentials are set up under the **Extensions** » **Amazon S3** tab, this happens automatically for any file upload field in a Checkout Fields Manager form. Forcing Files to Download ------------------------- Sometimes your browser tries to display or play a file instead of downloading it, like opening music or video directly in the browser. You can usually fix this with settings on your web server, but files stored on Amazon S3 ignore your web server's settings entirely. Instead, you need to configure this directly in S3. **Note:** This setting applies to individual files or folders, not the whole bucket. Opening File Properties ----------------------- In your S3 bucket, find the file you want to work with, select it, and click **Actions** » **Change metadata**. Click **Add Metadata**, set the Type to **System defined**, the Key to **Content-Disposition**, and the Value to **attachment**. Click **Save changes**. ![Metadaa in AWS.](https://easydigitaldownloads.com/wp-content/uploads/2022/01/image-3-800x283.png)This forces the file to download instead of playing or displaying in the browser. --- Troubleshooting and FAQs ------------------------ ### Files open in the browser instead of downloading See [Forcing Files to Download](#forcing-files-to-download) above. ### Can customers see the actual Amazon S3 URL and download the file directly? No. Customers see a URL pointing to your own store. EDD translates the location behind the scenes, so the download works without exposing the original Amazon S3 source URL. ### Error: SSL certificate problem: unable to get local issuer certificate This means the SSL certificate on your website's server is invalid or installed incorrectly. Contact your hosting company and ask them to verify the certificate is installed properly. ### Error: Access Denied This means the access key ID and secret key you're using don't have the permissions needed to access your S3 buckets and resources. To fix this, attach a new permissions policy to the IAM user. See [Creating an IAM Account](#creating-iam-account) above for the correct permissions. You may also see this error if you copied a URL directly from Amazon S3 and pasted it into the File URL field of your download. ### Error: RequestTimeTooSkewed This happens when your web server's timezone settings are misconfigured. Contact your hosting company and ask them to reconfigure the timezone settings. ### Error: SignatureDoesNotMatch If you see this error along with "The request signature we calculated does not match the signature you provided," your bucket name likely contains capital letters or spaces. Rename your bucket, or create a new one, using only lowercase letters and no spaces. ### Error: NoSuchKey The specified key does not exist This happens when there's an issue with how the file or bucket is named. Remove all punctuation and special characters from the name. For example, change `test-file-one.mp4.zip` to `testfileone.zip` . ### Other errors or problems uploading files to Amazon S3 If you're having trouble uploading files to Amazon S3 or accessing existing files, try these steps: 1. Check your Amazon S3 Endpoint setting under **Downloads** » **Settings** » **Extensions** » **Amazon S3**. Make sure it's set up correctly, including the right region. See [Amazon S3 Endpoint](#enter-amazon-s3-endpoint) above. 2. Make sure your filename is under the 1,024-character limit. See [Amazon's documentation](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMetadata.html) on formatting filenames correctly. 3. If you recently switched to a new Amazon S3 account and can't upload files to your bucket, this is usually temporary and resolves itself within a few hours. See [Amazon's documentation](https://docs.aws.amazon.com/AmazonS3/latest/dev/Redirects.html) for more information. 4. Still stuck? Contact [support](https://easydigitaldownloads.com/support) with the exact error message or behavior you're seeing. ### Software license updates failing with "Download failed. cURL error 8: Invalid Content-Length: value" This usually means the Amazon S3 feature isn't forcing redirect downloads. Try [setting the Download Method to Forced](https://easydigitaldownloads.com/docs/what-is-the-difference-between-forced-download-and-redirect-download/). ### Customer sees "Update Failed: Download failed. Internal Server Error" when updating a plugin Confirm the source file used for automatic updates is selected in the download's licensing settings. You'll likely see this PHP fatal error in your store's PHP error log: ``PHP Fatal error: Uncaught InvalidArgumentException: Found 2 errors while validating the input provided for the GetObject operation: [Key] is missing and is a required parameter [Key] expected string length to be >= 1, but found string length of 0 in /home/ph198/public_html/wp-content/plugins/edd-amazon-s3/vendor/aws/aws-sdk-php/src/Api/Validator.php:65``