How to set up an S3 bucket to use with Transloadit

Joseph Grabski

Content Lead · Rochester, United Kingdom · Show bio

Using Amazon S3 with Transloadit can be a powerful combination, but several customers have told us it can be a struggle to get things working just the way they want them to. To help them, and hopefully others as well, we've decided to write a comprehensive guide on how to integrate both services.

Creating a bucket

Naturally, our first step will be to make an AWS account. If you don't already have one, head to their sign-up page⁠ and follow the instructions provided.

After completing this, navigate to Storage and then select S3 from the Services tab as shown below.

From the Management Console, click Create Bucket. Give the bucket a name, and pick a region that is closest to the majority of your users. Keep a note of both the name and region as we'll need to pass this information to Transloadit later.

Keep Bucket owner enforced under Object Ownership, with ACLs disabled, and keep Block all public access enabled. Transloadit can store files in this private bucket by omitting object ACLs; our Template below sets acl to "bucket-default" for that purpose. You do not need to make the bucket public to import or export files. See AWS's Object Ownership guidance⁠.

Setting up Transloadit Credentials

Now our bucket is set up and ready to start storing our files! However, we still need to grab some credentials from AWS before we head to Transloadit to set up our Template.

Use a dedicated IAM user for this integration, not your AWS root user⁠. In IAM, give that user an identity policy restricted to your bucket. This export-only example permits listing the bucket, discovering its region, and writing objects. Replace YOUR_BUCKET_NAME in both resources:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetBucketLocation", "s3:ListBucket"],
      "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject"],
      "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*"
    }
  ]
}

This is an IAM identity policy attached to that user, not a bucket policy granting public access. If you also need to import objects, add s3:GetObject only for the object paths you need to read. Customer-managed KMS encryption can require additional key-specific permissions; do not grant wildcard administrative access to resolve permission errors.

Open the dedicated IAM user's security credentials and create an access key for this integration. Store the key and secret securely, rotate them according to your organization's policy, and never put them in browser code or a source repository.

The Console screenshots below show the English interface.

Now, go to the Credentials page on the Transloadit Console. Open Third-party Credentials, then click Add new Credential.

Select Amazon S3 as the Service, give the credential a memorable name, and assign the bucket name and region from before. Also make sure to add your access key and secret here.

Crafting a Template

Transloadit now has the credentials needed to export files to this bucket. Let's put it to the test!

The Template below will resize an uploaded image to 200x200 using the fillcrop strategy – thanks to our handy /image/resize Robot.

Afterwards, both the resized and original file will be uploaded to S3 for permanent storage.

{
  "steps": {
    ":original": {
      "robot": "/upload/handle"
    },
    "fillcropped": {
      "use": ":original",
      "robot": "/image/resize",
      "result": true,
      "height": 200,
      "width": 200,
      "imagemagick_stack": "v3",
      "resize_strategy": "fillcrop"
    },
    "exported": {
      "use": ["fillcropped", ":original"],
      "robot": "/s3/store",
      "credentials": "MY_S3_CREDENTIALS",
      "acl": "bucket-default"
    }
  }
}

Replace MY_S3_CREDENTIALS with the name you saved in Transloadit. After a successful Assembly, verify both objects in the S3 console using an identity with read access. The stored objects remain private: a result URL alone does not grant permission to download them. Use authenticated access or deliberately configured short-lived signed URLs when sharing private files.

That's the end of today's guide. We know that S3 can be tricky to set up, so please let us know whether you're still running into trouble and we'll be happy to offer support.