---
title: "Amazon S3 setup"
slug: "cloud-provider-amazon-s3-setup"
updated: 2026-10-09T18:06:37Z
published: 2026-10-09T18:06:37Z
canonical: "help.quickbase.com/cloud-provider-amazon-s3-setup"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.quickbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon S3 setup

Use these steps to prepare an Amazon S3 bucket for Quickbase Extensions and connect it in the installation wizard. You pay Amazon directly for storage—see [Amazon S3 pricing](https://aws.amazon.com/s3/pricing/).

## Before you start

- An AWS account. To create one, see [Getting started with Amazon S3](https://aws.amazon.com/s3/getting-started/).
- Permission in AWS to create S3 buckets and IAM users (or someone who has it).

## Step 1: Create a bucket

1. In the AWS Management Console, open **S3** and choose **Create bucket**.
2. Enter a bucket name and choose the AWS Region for the bucket. Note both—you need them in Step 3.
  - Choose one of the regions the wizard supports (see the list in Step 3). The wizard can't connect to a bucket in any other region.
  - Don't use periods (.) in the bucket name—for example, use *my-company-files* rather than *my.company.files*. With a period in the name, Document Portal can't preview files directly from the bucket. If your bucket already has one, add *hostedpreviews=y* to the Document Portal button so previews load through our server (see [Document Portal formula URL parameters](https://help.quickbase.com/quickbase-extensions/docs/en/document-portal-formula-url-parameters)).
3. Keep **Block all public access** turned on. Extensions access the bucket with your credentials, so the bucket does not need to be public.
4. Create the bucket.

## Step 2: Create an IAM user and access key

We recommend a dedicated IAM user that can only reach this bucket.

1. In the AWS Management Console, open **IAM** → **Users** → **Create user**. Give it a name such as *quickbase-extensions*. It does not need console access.
2. Attach a policy that grants access to your bucket. You can attach the AWS-managed **AmazonS3FullAccess** policy, or—recommended—create a custom policy limited to your bucket. Replace *your-bucket-name* with your bucket's name:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VerifyCredentials",
      "Effect": "Allow",
      "Action": "s3:ListAllMyBuckets",
      "Resource": "*"
    },
    {
      "Sid": "BucketAccess",
      "Effect": "Allow",
      "Action": ["s3:ListBucket", "s3:GetBucketLocation"],
      "Resource": "arn:aws:s3:::your-bucket-name"
    },
    {
      "Sid": "FileAccess",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::your-bucket-name/*"
    }
  ]
}
```

1. Open the new user, go to **Security credentials**, and choose **Create access key**. When asked for a use case, choose the option for a third-party service or an application running outside AWS.
2. Copy the **Access key ID** and **Secret access key**. The secret is only shown once—store it somewhere safe until you finish Step 3.

## Step 3: Connect in the installation wizard

When you set up an extension and choose Amazon S3, the wizard shows the **Amazon S3 Account Setup** step. The first time, enter:

| **Field** | **What to enter** |
| --- | --- |
| **S3 Access Key** (required) | The Access key ID from Step 2. |
| **S3 Secret Key** (required) | The Secret access key from Step 2. |
| **Select a Region** (required) | The region you chose for the bucket in Step 1, for example *US East (Virginia)* or *EU West (Ireland)*. |
| **S3 Bucket** (required) | The bucket name from Step 1. This becomes your default bucket. |

**Select a Region** lists these 17 regions:

- US East (Virginia), US East (Ohio), US West (Oregon), US West (N.California), US GovCloud West (Oregon)
- Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Mumbai), Asia Pacific (Singapore), Asia Pacific (Sydney)
- Canada (Central), China (Beijing)
- EU Central (Frankfurt), EU West (Ireland), EU West (London), EU (Paris)
- South America (Sao Paulo)

When you continue, the wizard checks the credentials and the bucket. If something is wrong, you see one of these messages:

- *Unable to use credentials to access S3. Please double-check that all credentials are correct.*—check the access key, secret key, and region, and that the IAM user's policy is attached.
- *Bucket not found using given S3 Credentials! Please ensure the bucket's name is correct and that it exists in the correct account.*—check the bucket name, and that the bucket is in the same AWS account as the IAM user.

Once your Amazon S3 details are saved, later setups show your saved access key and secret key masked (only the last 4 characters are visible), your saved region, and your default bucket. You can't change them on this step. An optional **Override Bucket** box is also shown: enter a different bucket name there to use it for that setup only, or leave it blank to use your default bucket.

## Update your access key after setup

If you rotate or replace the IAM user's access key, update the saved key in the Extensions Portal. You must be a **Client Admin** to see this option.

1. Sign in to the Extensions Portal and select **Client Credentials** in the left menu. The credentials window opens.
2. In the **Amazon S3** section, the saved **Access Key** and **Secret Key** are shown masked. To check a value, press and hold the eye button next to it.
3. Click **Edit** next to the key you want to change, enter the new value, and enter it again in the confirm box that appears.
4. Click **Update S3 Credentials**, or **Cancel** to discard the change.

> [!NOTE]
> Note
> 
> **Client Credentials** updates the access key and secret key only. To change your saved default bucket or region, submit a [technical support case](https://help.quickbase.com/docs/get-help-from-quickbase-technical-support).