Amazon S3 Storage

Skymage uses AWS Signature Version 4 to read objects from Amazon S3 and compatible providers.

Required Configuration

Field	Description
Access key ID	Credential with read access to the bucket.
Secret access key	Secret paired with the access key ID.
Bucket	Bucket containing the source images.
Region	Bucket region, such as us-east-1.
Endpoint	Optional S3-compatible endpoint.

Amazon S3 uses virtual-hosted URLs. Custom endpoints use path-style URLs with the bucket name appended.

Least-Privilege Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::your-bucket-name",
        "arn:aws:s3:::your-bucket-name/*"
      ]
    }
  ]
}

The bucket does not need public-read access. Skymage signs storage requests with the configured credentials.

Example Configuration

{
  "access_key_id": "YOUR_ACCESS_KEY_ID",
  "secret_access_key": "YOUR_SECRET_ACCESS_KEY",
  "bucket": "product-images",
  "region": "us-east-1"
}

S3-compatible endpoint:

{
  "access_key_id": "YOUR_ACCESS_KEY_ID",
  "secret_access_key": "YOUR_SECRET_ACCESS_KEY",
  "bucket": "product-images",
  "region": "us-east-1",
  "endpoint": "https://objects.example.com"
}

Image URL

https://demo.skymage.net/v1/ex/product-images/catalog/item-001.jpg?w=480&h=480&fit=cover&f=avif&q=80

Troubleshooting

• Confirm the bucket region exactly matches the configuration.
• Confirm the credentials allow s3:GetObject and s3:ListBucket.
• Confirm the object path is relative to the bucket root.
• For compatible providers, include the endpoint scheme and hostname.