How to Configure Amazon S3 CDN
This guide follows Amazon’s official console steps to create a bucket and access keys, then paste them into XFile Ultra.
Sources: Create a general purpose bucket · Create an IAM access key · IAM user + access keys for CLI/apps
---
Where this goes in XFile Ultra
Admin → Servers → Servers management → Add new CDN (or edit an existing CDN)
Provider: Amazon S3
---
What to paste into XFile Ultra
| XFile Ultra field | Copy from AWS |
|---|---|
| Access key ID | IAM Access key |
| Secret access key | IAM Secret access key (shown once) |
| Bucket name | S3 Bucket name |
| Region | Bucket AWS Region code (e.g. us-east-1, eu-west-1) |
| Public / custom domain URL | Optional (CloudFront / custom host) |
You do not paste an endpoint for Amazon S3. XFile Ultra uses https://s3.<region>.amazonaws.com.
---
Step 1 — Create the S3 bucket (AWS console)
Per Amazon S3: Using the S3 console:
1. Sign in to the AWS Management Console and open Amazon S3: https://console.aws.amazon.com/s3/
2. In the top navigation bar, click the currently displayed AWS Region name, then choose the Region where you want the bucket (you cannot change Region after creation)
3. In the left navigation pane, choose General purpose buckets
4. Choose Create bucket
5. For Bucket name, enter a name (3–63 characters; lowercase letters, numbers, periods, hyphens; must start and end with a letter or number). You cannot rename later
6. Leave the rest at defaults unless you know you need changes:
- Object Ownership: default Bucket owner enforced (ACLs disabled) is fine
- Block Public Access: keep all four settings enabled (recommended). XFile Ultra uses presigned URLs, so the bucket can stay private
- Bucket Versioning: leave disabled unless you need it
7. Scroll to the bottom and choose Create bucket
Write down:
- The exact Bucket name
- The Region code (example:
eu-central-1— use the code, not only the city name)
---
Step 2 — Create an IAM user for S3
Do not use your AWS root account access keys.
Per AWS’s IAM / CLI getting-started guidance:
1. Open the IAM console: https://console.aws.amazon.com/iam/
2. In the left navigation pane, choose Users
3. Choose Create user
4. Enter a user name (example: xfileultra-s3) → Next
5. Under permission options, choose Attach policies directly
6. In the policy search box, find and select AmazonS3FullAccess (enough for XFile Ultra uploads, downloads, and CORS setup). For tighter production security you can later replace this with a custom policy limited to one bucket
7. Choose Next → review → Create user
---
Step 3 — Create the Access key and Secret access key
Per How an IAM administrator can manage IAM user access keys:
1. Still in IAM → Users, click the user name you just created
2. Open the Security credentials tab
3. Scroll to Access keys → choose Create access key
4. On Access key best practices & alternatives, choose Other (or Application running outside AWS / Command Line Interface (CLI) if shown) → Next
5. Optional description tag → choose Create access key
6. On Retrieve access key:
- Copy the Access key
- Choose Show to reveal the Secret access key, or choose Download .csv file
7. Choose Done
AWS will not show the secret again after you leave this page.
---
Step 4 — Map values into XFile Ultra
| Field | Value |
|---|---|
| Access key ID | Access key from Step 3 |
| Secret access key | Secret access key from Step 3 |
| Bucket name | Bucket from Step 1 |
| Region | Region code from Step 1 |
Finish in XFile Ultra
1. Open Admin → Servers → Servers management → Add new CDN (or edit an existing CDN)
2. Choose the matching CDN provider
3. Paste every value from the “What to paste” table
4. Leave Performance mode on unless you want uploads to proxy through your VPS
5. Set the server status to ON when ready
6. Click Test connection
7. Click Save
If Test connection succeeds but says Performance mode requires bucket CORS, open Performance mode requires bucket CORS and paste the rule for your provider.
---
Common problems
Bucket not found / wrong region or endpoint
The bucket name must match exactly. The region (or Contabo / IDrive endpoint, or Cloudflare Account ID) must be the one for that bucket.
Access denied / bad credentials
Wrong Access Key ID or Secret Access Key, or the key cannot read/write that bucket. Create a new key with the right permissions and paste again.
Secret key lost
Almost every provider shows the secret once. You cannot look it up later — create or regenerate a key, update XFile Ultra, and stop using the old key.
Test connection OK, browser upload fails
Usually CORS. Use the Performance mode CORS article, or turn Performance mode off temporarily while you fix it.