Introduction

This article describes how to use an Amazon Web Service (AWS) Simple Storage Service (S3) bucket in order to host the Triofox backend storage. In an effort to follow the "principle of least privilege", this configuration will use an AWS Identity and Access Management (IAM) user that is limited to accessing only a single S3 bucket in an AWS account. This IAM account could be thought of as a "service account", for the benefit of the Triofox service.

Configuration

Create a S3 Bucket

1. Sign into the AWS portal and navigate to the S3 console. 
2. Click the Create bucket button:
   
3. Fill out the fields in the Create bucket UI:
   1. The Bucket name must follow DNS naming conventions and be globally unique. In this example the bucket name "tfshare01-triofox" was used. It indicates the company (triofox).
   2. Select an AWS Region that is in the same region as the Triofox server if Triofox is hosted at AWS, or a region that is closest geographically to the Triofox server if not hosted in AWS.
   3. There is likely no need to copy settings from an existing bucket.
   4. Click the Next button:
       
4. In the next panel:
   1. Make sure that Versioning is disabled because Triofox has it's own versioning built in. It's normally disabled by default.
   2. The other settings should most likely be disabled unless you have a business reason to enable them.
   3. Click the Next button:
       
5. In the next panel,
   1.  Keep the defaults with all options enabled to prevent public access to the bucket.
   2. Click the Next button:
       
6. Review the settings then click the Create bucket button:
   
7. Click on the bucket name in the S3 console:
   
8. Notice the bucket is currently empty:
   
9. In the AWS portal, navigate to the IAM service.
10. Click the Policies node:
    
11. Click the Create policy button
12. The "Visual editor" is too slow. Click on the JSON tab:
    
13. AWS provides an example of the necessary IAM policy here: 
    https://docs.aws.amazon.com/AmazonS3/latest/dev/example-policies-s3.html#iam-policy-ex0

14. Copy this text from the AWS documentation:

    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Action": [
    "s3:ListAllMyBuckets"
    ],
    "Resource": "arn:aws:s3:::*"
    },
    {
    "Effect": "Allow",
    "Action": [
    "s3:ListBucket",
    "s3:GetBucketLocation"
    ],
    "Resource": "arn:aws:s3:::tfshare01-triofox"
    },
    {
    "Effect": "Allow",
    "Action": [
    "s3:PutObject",
    "s3:PutObjectAcl",
    "s3:GetObject",
    "s3:GetObjectAcl",
    "s3:DeleteObject"
    ],
    "Resource": "arn:aws:s3:::tfshare01-triofox/*"
    }
    ]
    }
    

15. Paste it into a text editor like Visual Studio Code and save it as a .json file (it will be easier to read).
16. Search and replace all occurrences of examplebucket with the name of the S3 bucket that was created (in this example tfshare01-triofox). Note that this is not the name of the IAM user but rather the S3 bucket that the IAM user will be granted access.
17. Select all of the text in the text editor and paste it into the JSON text box in the IAM console, replacing any text that was automatically generated, then click the Review policy button:
    
18. Click on "Next Tags"
19. Click on "Next Review"
20. In the Create policy panel,
    1. Set the Name text box to something descriptive (spaces are not allowed)
    2. Set the Description text box to something that explains what this custom policy is allowing
    3. Click the Create policy button:
       
21. Notice the custom policy is listed:
    
22. Click the Users node:
    
23. Click the Add user button:
24. In the Add user panel,
    1. In the User name field provide some text that indicates what the "service account" will be used for:
    2. Enable the Programmatic access option
    3. Disable the AWS Management Console access option as this user will not need access to the AWS console.
    4. Click the Next: Permissions button:
       
    5. 
25. Click the Attach existing policies directly tab:
    
26. Review the user and policy that will be attached to the user then click the Create user button:
    
27. Now the user "svc-triofox" is created.
28. Click on the user, and click on the "Security credentials" tab, then click on "Create access key"
29. Select "Application running outside AWS" or else. Click on "Next" 
30. Click on "Create access key"
31. Click the Download .csv button:
    
32. The recommendation is to store the Access key ID and Secret access key in a secure place such as LastPass or similar. These keys are the information required to sign into AWS programmatically as this IAM user. 

Publish the newly created S3 bucket

1. Sign into the Triofox console as the cluster admin.
2. Enter your share name and storage type "Amazon S3", click on "Next"
3. Enter the Amazon Access Key and Secret Key.
4. Select the bucket you want to publish, and click on "Finish"
    
5. You  can grant user permisson now or later, click "Publish"
    
6. Now the S3 bucket was published.