AWS Deployment Guide for S3 Integration

This guide walks you through setting up AWS S3 for your Spring Boot application deployment on EC2.

Prerequisites

✅ EC2 instance already running
AWS Console access with appropriate permissions

Step 1: Create S3 Bucket

Log into AWS Console
- Go to https://console.aws.amazon.com
- Navigate to S3 service (search "S3" in the top search bar)
Create Bucket
- Click "Create bucket" button
- Bucket name: Enter a unique name (e.g., yourcompany-product-images-prod)
  - ⚠️ Bucket names must be globally unique across all AWS accounts
  - Use lowercase letters, numbers, hyphens only
  - Example: amigoscode-product-images-2024
Configure Bucket Settings
- AWS Region: Select your region (e.g., us-east-1 - same as your EC2 region)
- Object Ownership: Select "ACLs disabled (recommended)"
- Block Public Access:
  - ✅ Keep all settings enabled (unless you need public access to images)
  - If you want public image access, uncheck "Block all public access" and acknowledge
- Versioning: Disable (unless you need versioning)
- Encryption: Choose "Enable" → "Amazon S3 managed keys (SSE-S3)" (recommended)
- Tags: Optional - add tags for organization
Create Bucket
- Click "Create bucket" button at the bottom
- Note down your bucket name - you'll need it for configuration

Step 2: Create IAM User for Application Access

Option A: IAM User with Access Keys (Recommended for EC2)

Navigate to IAM
- In AWS Console, search for "IAM" and open the service
- Click "Users" in the left sidebar
- Click "Create user" button
Set User Details
- User name: product-service-s3-user (or your preferred name)
- Select credential type: ✅ Check "Provide user access to the AWS Management Console" (optional, for testing)
- Or just check "Access key - Programmatic access" (for API access only)
- Click "Next"
Set Permissions
- Select "Attach policies directly"
- Click "Create policy" button (opens in new tab)

Create Custom Policy

In the new tab, click "JSON" tab
Replace the content with:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:HeadObject"
            ],
            "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME"
        }
    ]
}

Replace YOUR-BUCKET-NAME with your actual bucket name (e.g., amigoscode-product-images-2024)
Click "Next"
Policy name: ProductServiceS3Policy
Description: Allows S3 access for product image service
Click "Create policy"
Go back to the user creation tab

Attach Policy to User
- Refresh the policy list (click refresh icon)
- Search for ProductServiceS3Policy
- ✅ Check the box next to your policy
- Click "Next"
Review and Create
- Review the settings
- Click "Create user"
Save Access Keys ⚠️ CRITICAL - DO THIS NOW
- After creating user, you'll see "Access key" section
- Click "Create access key"
- Use case: Select "Application running outside AWS"
- Click "Next"
- Click "Create access key"
- ⚠️ IMPORTANT:
  - Copy the Access Key ID (e.g., AKIAIOSFODNN7EXAMPLE)
  - Copy the Secret Access Key (e.g., wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY)
  - Download CSV file as backup
  - You cannot view the secret key again after closing this page
- Click "Done"

Step 3: Configure EC2 Instance with Credentials

Method 1: Using IAM Role (Recommended - More Secure)

Create IAM Role
- In IAM Console, click "Roles" in left sidebar
- Click "Create role"
- Select trusted entity: "AWS service"
- Use case: Select "EC2"
- Click "Next"
Attach Permissions
- Search for ProductServiceS3Policy (the policy you created earlier)
- ✅ Check the box
- Click "Next"
Name Role
- Role name: EC2-S3-Access-Role
- Description: Allows EC2 instance to access S3 bucket
- Click "Create role"
Attach Role to EC2 Instance
- Go to EC2 Console → Instances
- Select your EC2 instance
- Click "Actions" → "Security" → "Modify IAM role"
- Select EC2-S3-Access-Role
- Click "Update IAM role"

Method 2: Using Environment Variables (Alternative)

If you prefer using access keys directly:

SSH into your EC2 instance

ssh -i your-key.pem ec2-user@your-ec2-ip

Set environment variables (add to /etc/environment or your deployment script)

sudo nano /etc/environment

Add these lines:

AWS_ACCESS_KEY_ID=your-access-key-id
AWS_SECRET_ACCESS_KEY=your-secret-access-key
AWS_DEFAULT_REGION=us-east-1

Or create a .env file in your application directory:

nano ~/app/.env

AWS_ACCESS_KEY_ID=your-access-key-id
AWS_SECRET_ACCESS_KEY=your-secret-access-key
AWS_DEFAULT_REGION=us-east-1

Step 4: Update Application Configuration

Option A: Using Environment Variables (Recommended)

Create or update your application.properties for production:

# AWS S3 Configuration (Production)
aws.region=us-east-1
aws.s3.bucket=your-bucket-name-here
aws.s3.endpoint-override=
aws.s3.path-style-enabled=false
aws.access-key-id=${AWS_ACCESS_KEY_ID}
aws.secret-access-key=${AWS_SECRET_ACCESS_KEY}

Option B: Direct Configuration (Less Secure)

If not using environment variables:

# AWS S3 Configuration (Production)
aws.region=us-east-1
aws.s3.bucket=your-bucket-name-here
aws.s3.endpoint-override=
aws.s3.path-style-enabled=false
aws.access-key-id=AKIAIOSFODNN7EXAMPLE
aws.secret-access-key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

⚠️ Security Note: Never commit access keys to version control!

Step 5: Update Application Code (if needed)

If using IAM Role (Method 1), you need to update AwsS3Config.java to support IAM roles:

The current code uses StaticCredentialsProvider. If using IAM roles, AWS SDK will automatically use instance credentials. Update the config:

@Bean
public S3Client s3Client() {
    S3ClientBuilder builder = S3Client.builder()
            .region(Region.of(region))
            .serviceConfiguration(
                    S3Configuration
                            .builder()
                            .pathStyleAccessEnabled(pathStyleEnabled)
                            .build()
            );
    
    // Only use static credentials if access key is provided
    if (StringUtils.isNotBlank(accessKeyId) && !accessKeyId.equals("minioadmin")) {
        builder = builder.credentialsProvider(StaticCredentialsProvider.create(
                AwsBasicCredentials.create(accessKeyId, secretAccessKey))
        );
    }
    // Otherwise, AWS SDK will use default credential chain (IAM role, env vars, etc.)
    
    if (StringUtils.isNotBlank(endpointOverride)) {
        builder = builder.endpointOverride(URI.create(endpointOverride));
    }
    return builder.build();
}

Step 6: Deploy Application to EC2

Build your application
```
mvn clean package
```

Transfer JAR to EC2

scp -i your-key.pem target/product-service.jar ec2-user@your-ec2-ip:~/app/

SSH into EC2

ssh -i your-key.pem ec2-user@your-ec2-ip

Create application.properties for production
```
cd ~/app
nano application.properties
```
Add production configuration (see Step 4)

Run application

java -jar product-service.jar --spring.config.location=application.properties

Or with environment variables:

export AWS_ACCESS_KEY_ID=your-key-id
export AWS_SECRET_ACCESS_KEY=your-secret-key
export AWS_DEFAULT_REGION=us-east-1
java -jar product-service.jar

Step 7: Verify S3 Integration

Test Image Upload
- Use your application's API to upload a product image
- Go to S3 Console → Your bucket
- Verify the image appears in products/ folder
Check Permissions
- If upload fails, verify:
  - IAM role/policy is attached correctly
  - Bucket name matches configuration
  - Region matches your EC2 instance region

Security Best Practices

✅ Use IAM Roles instead of access keys when possible (Method 1)
✅ Never commit credentials to version control
✅ Use environment variables or AWS Secrets Manager for sensitive data
✅ Restrict S3 bucket access to specific IPs if needed (via bucket policy)
✅ Enable S3 bucket versioning for production (if needed)
✅ Enable CloudTrail to audit S3 access (optional but recommended)

Troubleshooting

Issue: "Access Denied" when uploading

Solution: Verify IAM policy permissions and bucket name
Check CloudTrail logs for detailed error messages

Issue: "Bucket not found"

Solution: Verify bucket name matches exactly (case-sensitive)
Ensure bucket is in the same region as configured

Issue: "Invalid endpoint"

Solution: Remove aws.s3.endpoint-override property for production
Set aws.s3.path-style-enabled=false for AWS S3

Testing Credentials

aws s3 ls s3://your-bucket-name/ --region us-east-1

Next Steps

Set up CloudFront CDN for image delivery (optional)
Configure S3 lifecycle policies for old images
Set up monitoring with CloudWatch
Configure backup strategies

Navigation Menu

Repository navigation

AWS_DEPLOYMENT_GUIDE.md

AWS_DEPLOYMENT_GUIDE.md

AWS Deployment Guide for S3 Integration

Prerequisites

Step 1: Create S3 Bucket

Step 2: Create IAM User for Application Access

Option A: IAM User with Access Keys (Recommended for EC2)

Step 3: Configure EC2 Instance with Credentials

Method 1: Using IAM Role (Recommended - More Secure)

Method 2: Using Environment Variables (Alternative)

Step 4: Update Application Configuration

Option A: Using Environment Variables (Recommended)

Option B: Direct Configuration (Less Secure)

Step 5: Update Application Code (if needed)

Step 6: Deploy Application to EC2

Step 7: Verify S3 Integration

Security Best Practices

Troubleshooting

Issue: "Access Denied" when uploading

Issue: "Bucket not found"

Issue: "Invalid endpoint"

Testing Credentials

Next Steps

FilesExpand file tree

AWS_DEPLOYMENT_GUIDE.md

Latest commit

History

AWS_DEPLOYMENT_GUIDE.md

File metadata and controls

AWS Deployment Guide for S3 Integration

Prerequisites

Step 1: Create S3 Bucket

Step 2: Create IAM User for Application Access

Option A: IAM User with Access Keys (Recommended for EC2)

Step 3: Configure EC2 Instance with Credentials

Method 1: Using IAM Role (Recommended - More Secure)

Method 2: Using Environment Variables (Alternative)

Step 4: Update Application Configuration

Option A: Using Environment Variables (Recommended)

Option B: Direct Configuration (Less Secure)

Step 5: Update Application Code (if needed)

Step 6: Deploy Application to EC2

Step 7: Verify S3 Integration

Security Best Practices

Troubleshooting

Issue: "Access Denied" when uploading

Issue: "Bucket not found"

Issue: "Invalid endpoint"

Testing Credentials

Next Steps