Use these steps to prepare an Amazon S3 bucket for Quickbase Extensions and connect it in the installation wizard. You pay Amazon directly for storage—see Amazon S3 pricing.
Before you start
An AWS account. To create one, see Getting started with Amazon S3.
Permission in AWS to create S3 buckets and IAM users (or someone who has it).
Step 1: Create a bucket
In the AWS Management Console, open S3 and choose Create bucket.
Enter a bucket name and choose the AWS Region for the bucket. Note both—you need them in Step 3.
Choose one of the regions the wizard supports (see the list in Step 3). The wizard can't connect to a bucket in any other region.
Don't use periods (.) in the bucket name—for example, use my-company-files rather than my.company.files. With a period in the name, Document Portal can't preview files directly from the bucket. If your bucket already has one, add hostedpreviews=y to the Document Portal button so previews load through our server (see Document Portal formula URL parameters).
Keep Block all public access turned on. Extensions access the bucket with your credentials, so the bucket does not need to be public.
Create the bucket.
Step 2: Create an IAM user and access key
We recommend a dedicated IAM user that can only reach this bucket.
In the AWS Management Console, open IAM → Users → Create user. Give it a name such as quickbase-extensions. It does not need console access.
Attach a policy that grants access to your bucket. You can attach the AWS-managed AmazonS3FullAccess policy, or—recommended—create a custom policy limited to your bucket. Replace your-bucket-name with your bucket's name:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VerifyCredentials",
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "*"
},
{
"Sid": "BucketAccess",
"Effect": "Allow",
"Action": ["s3:ListBucket", "s3:GetBucketLocation"],
"Resource": "arn:aws:s3:::your-bucket-name"
},
{
"Sid": "FileAccess",
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
"Resource": "arn:aws:s3:::your-bucket-name/*"
}
]
}Open the new user, go to Security credentials, and choose Create access key. When asked for a use case, choose the option for a third-party service or an application running outside AWS.
Copy the Access key ID and Secret access key. The secret is only shown once—store it somewhere safe until you finish Step 3.
Step 3: Connect in the installation wizard
When you set up an extension and choose Amazon S3, the wizard shows the Amazon S3 Account Setup step. The first time, enter:
Field | What to enter |
|---|---|
S3 Access Key (required) | The Access key ID from Step 2. |
S3 Secret Key (required) | The Secret access key from Step 2. |
Select a Region (required) | The region you chose for the bucket in Step 1, for example US East (Virginia) or EU West (Ireland). |
S3 Bucket (required) | The bucket name from Step 1. This becomes your default bucket. |
Select a Region lists these 17 regions:
US East (Virginia), US East (Ohio), US West (Oregon), US West (N.California), US GovCloud West (Oregon)
Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Mumbai), Asia Pacific (Singapore), Asia Pacific (Sydney)
Canada (Central), China (Beijing)
EU Central (Frankfurt), EU West (Ireland), EU West (London), EU (Paris)
South America (Sao Paulo)
When you continue, the wizard checks the credentials and the bucket. If something is wrong, you see one of these messages:
Unable to use credentials to access S3. Please double-check that all credentials are correct.—check the access key, secret key, and region, and that the IAM user's policy is attached.
Bucket not found using given S3 Credentials! Please ensure the bucket's name is correct and that it exists in the correct account.—check the bucket name, and that the bucket is in the same AWS account as the IAM user.
Once your Amazon S3 details are saved, later setups show your saved access key and secret key masked (only the last 4 characters are visible), your saved region, and your default bucket. You can't change them on this step. An optional Override Bucket box is also shown: enter a different bucket name there to use it for that setup only, or leave it blank to use your default bucket.
Update your access key after setup
If you rotate or replace the IAM user's access key, update the saved key in the Extensions Portal. You must be a Client Admin to see this option.
Sign in to the Extensions Portal and select Client Credentials in the left menu. The credentials window opens.
In the Amazon S3 section, the saved Access Key and Secret Key are shown masked. To check a value, press and hold the eye button next to it.
Click Edit next to the key you want to change, enter the new value, and enter it again in the confirm box that appears.
Click Update S3 Credentials, or Cancel to discard the change.
Note
Client Credentials updates the access key and secret key only. To change your saved default bucket or region, submit a technical support case.