Amazon S3 Configuration

1. Create an AWS IAM Policy (Least-Privilege)

Never use root credentials or full Administrator privileges. Create a dedicated IAM policy containing only the exact permissions Clockwork Offloader requires to store, read, and delete media files.

1. Open the AWS IAM Console.
2. Click Policies → Create policy.
3. Switch to the JSON tab and paste the following policy (replace your-media-bucket-name with your actual bucket name):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ClockworkBucketAccess",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": "arn:aws:s3:::your-media-bucket-name"
    },
    {
      "Sid": "ClockworkObjectAccess",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:PutObjectAcl"
      ],
      "Resource": "arn:aws:s3:::your-media-bucket-name/*"
    }
  ]
}

2. Create the Dedicated IAM User

1. In the IAM Console, navigate to Users → Create user.
2. Enter a name such as clockwork-offloader-user. Do not enable AWS Management Console access.
3. Under Set permissions, choose Attach policies directly and select the policy created in Step 1.
4. After creating the user, click on the user name → Security credentials → Create access key.
5. Choose Application running outside AWS. Save your Access Key ID and Secret Access Key securely.

3. Create Your S3 Bucket

1. Navigate to the AWS S3 Console and click Create bucket.
2. Enter a globally unique bucket name (e.g., media.yourcompany.org or company-wp-media).
3. Select the AWS Region geographically closest to your audience (e.g. us-east-1, us-east-2, eu-west-1).
4. Object Ownership: Select ACLs enabled (Bucket owner preferred) if you plan on serving files directly from S3 without CloudFront. If using CloudFront with Origin Access Control (OAC), ACLs disabled is recommended.

4. Configure CORS (Cross-Origin Resource Sharing)

If your media library contains SVGs, custom web fonts, or images loaded dynamically via JavaScript canvas, you must configure CORS on the bucket:

1. In your bucket settings, click the Permissions tab.
2. Scroll down to Cross-origin resource sharing (CORS) and click Edit.
3. Paste the following JSON:

[
  {
    "AllowedHeaders": ["*"],
    "AllowedMethods": ["GET", "HEAD"],
    "AllowedOrigins": ["https://yourdomain.com", "https://*.yourdomain.com"],
    "ExposeHeaders": ["ETag"],
    "MaxAgeSeconds": 86400
  }
]