Configure Amazon S3 Storage

Connect a private Amazon S3 bucket to Coolify so it can store backup files. This guide creates bucket-scoped IAM credentials and validates the storage connection in Coolify.

Example data

Replace these example values with your own values while following the guide:

S3 Bucket Name: envix-coolify-backups-s3
IAM Policy Name: EnvixCoolifyBackupS3Access
IAM Username: EnvixCoolifyBackupS3User
Endpoint: https://s3.ap-northeast-2.amazonaws.com

The short version

Create a bucket in the AWS Console.
Create a custom IAM policy with the permissions below.
Create an IAM user and attach the policy.
Create an access key for the IAM user.
Add the access key and secret key when you create the S3 storage in Coolify.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:GetObjectAcl",
        "s3:PutObjectAcl",
        "s3:PutObject"
      ],
      "Resource": [
        "arn:aws:s3:::your-bucket-name",
        "arn:aws:s3:::your-bucket-name/*"
      ]
    }
  ]
}

Replace your-bucket-name in both resource values with your bucket name.

Endpoint format

Use the S3 HTTP endpoint without the bucket name, for example https://s3.eu-central-1.amazonaws.com.

Set up Amazon S3

Create an S3 bucket

Open the Amazon S3 console and select Create bucket.

Create bucket button in the Amazon S3 console

Enter the bucket name and choose its AWS Region, object ownership, and other settings.

Amazon S3 bucket name and Region settings

Keep the default settings unless you need different controls

The default settings work for a standard private backup bucket. Change encryption, versioning, object ownership, or public access only when your AWS requirements call for it.

Amazon S3 bucket object ownership settings

Select Create bucket. After AWS creates the bucket, it appears in the bucket list.

Create an IAM policy

Open IAM Policies and select Create policy.

Choose the JSON policy editor.

Paste this policy into the editor:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:GetObjectAcl",
        "s3:PutObjectAcl",
        "s3:PutObject"
      ],
      "Resource": [
        "arn:aws:s3:::envix-coolify-backups-s3",
        "arn:aws:s3:::envix-coolify-backups-s3/*"
      ]
    }
  ]
}

Replace envix-coolify-backups-s3 in both resource values with the bucket name created in the previous step.

Continue to the policy details and enter the policy name.

Create the policy. AWS opens the policy page after creation.

Find the new policy by name

If the policy does not appear immediately in a list, search for the exact policy name you entered.

Create an IAM user

Open IAM Users and select Create user.

Enter the IAM username.

Select Next after entering the name.

AWS IAM permission options for the new user

Select Attach policies directly.
Select the policy created in the previous step.
Select Next.

Review the user and select Create user.

Select the username to create its access key.

Create an access key

On the IAM user page, open Security credentials.

Security credentials tab for the AWS IAM user

Under Access keys, select Create access key.

Choose Other, then continue.

Create access key confirmation in AWS IAM

Select Create access key.

AWS IAM access key and secret access key

Save the Access key and Secret access key somewhere secure, then select Done.

Save the secret access key before leaving

AWS does not show the secret access key again after you close this page. If you lose it, create a replacement access key.

Set up Amazon S3 in Coolify

In the Coolify dashboard, open S3 Storages from the sidebar.

S3 Storages section in the Coolify sidebar

Select Add.

Complete the form:

Enter a name for the S3 storage. This name only identifies it in Coolify.
Enter an optional description.
Enter the endpoint without the bucket name, such as https://s3.YOUR_REGION_NAME.amazonaws.com.
Enter the S3 bucket name.
Enter the bucket's AWS Region.
Enter the IAM Access Key.
Enter the IAM Secret Key.
Select Validate Connection & Continue.

After validation succeeds, Coolify opens the storage details page.

Amazon S3 storage is ready

The connection is configured and validated. You can now select this storage when you configure an instance backup or a database backup.