Amazon S3 & S3-compatible storage

Upload-Here needs an access key that is allowed to write new objects into your bucket. It does not need read or delete access.

This guide is for Amazon S3. The same steps work for S3-compatible services such as Cloudflare R2, Wasabi, Backblaze B2, Hetzner Object Storage or MinIO — use their access keys and set the Custom endpoint field (see S3-compatible services).

1. Create an IAM policy

In the AWS console open IAM → Policies → Create policy → JSON and paste the policy below. Replace YOUR-BUCKET (and optionally restrict the resource to a folder, e.g. YOUR-BUCKET/uploads/*).

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "UploadHereUploadOnly",
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts"],
      "Resource": "arn:aws:s3:::YOUR-BUCKET/*"
    },
    {
      "Sid": "OptionalKeepOriginalFileNames",
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": "arn:aws:s3:::YOUR-BUCKET"
    }
  ]
}

The second statement is optional. With it, we can check whether a file name is already taken and keep the original name when it isn't. Without it, every uploaded file gets a timestamp suffix so nothing is overwritten.

Name the policy, e.g. UploadHereUploadOnly.

2. Create an IAM user and access key

1. IAM → Users → Create user, e.g. upload-here. No console access is needed.
2. Attach the policy from step 1 directly.
3. Open the user → Security credentials → Create access key → Application running outside AWS.
4. Copy the Access key ID and Secret access key.

3. Configure CORS on the bucket

Customers upload from their browser, so the bucket must allow requests from Upload-Here. Open S3 → your bucket → Permissions → Cross-origin resource sharing (CORS) and paste:

[
  {
    "AllowedOrigins": ["https://new.upload-here.com"],
    "AllowedMethods": ["PUT"],
    "AllowedHeaders": ["*"],
    "ExposeHeaders": ["ETag"],
    "MaxAgeSeconds": 3600
  }
]

ExposeHeaders: ["ETag"] is required — multipart uploads can't be completed without it.

4. Add the credentials to Upload-Here

Go to Dashboard → Storage → Amazon S3, enter the access key, secret and the bucket's region (e.g. eu-central-1). Enter your bucket name under Test bucket and click Test & save — we start and immediately cancel a test upload to verify everything works.

S3-compatible services

Service	Endpoint	Region
Cloudflare R2	https://<account-id>.r2.cloudflarestorage.com	auto
Wasabi	https://s3.<region>.wasabisys.com	e.g. eu-central-1
Backblaze B2	https://s3.<region>.backblazeb2.com	e.g. eu-central-003
Hetzner	https://<location>.your-objectstorage.com	e.g. fsn1
MinIO	your MinIO URL	us-east-1

Configure CORS on the bucket in the provider's console with the same rules as above (allow PUT from https://new.upload-here.com, expose ETag).