Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 3 down vote favorite

I want students to publish their static websites to Amazon S3. But I can't have them all create AWS accounts because it requires their credit cards even for the free usage tier. I don't mind letting them use an account I setup (I'm happy to pay amazon's fees for usage too), but I need to give students their own directory and credentials to upload files. Is this possible with Amazon S3?

share|improve this question
Why not just give them FTP like in the days of old? – Mikhail Oct 16 '12 at 10:16

3 Answers

up vote 5 down vote

Amazon IAM ( http://aws.amazon.com/iam/ ) service gives you the ability to create accounts for students with separate password/credentials and with access to only specified AWS resources.

You can create one account for all students there, or create a group called "Students" and assign all your students to that group.

After doing that you need to specify an access policy that permits them to upload files on specified bucket on S3.

Example of such policy can look like this:

{
 "Statement": [
{
  "Effect": "Allow",
  "Action": "s3:ListAllMyBuckets",
  "Resource": "arn:aws:s3:::*"
},
{
  "Effect": "Allow",
  "Action": "s3:*",
  "Resource": [
    "arn:aws:s3:::bucket-name",
    "arn:aws:s3:::bucket-name/*"
  ]
}]}

This policy will allow users to list all buckets and upload/delete files only in bucket called "bucket-name".

share|improve this answer
This seems perfect. Only that I have to create a new bucket for each student... I guess not a big deal. – at01 Oct 16 '12 at 16:52
It depends on how many students you have. There is a limit for 100 buckets per account ( docs.amazonwebservices.com/AmazonS3/latest/dev/… ). You could also create one bucket and add subfolders. Not sure if this satisfies you. I would be like s3.page.address.com/student1/ , s3.page.address.com/student2/ etc... – mateuszzawisza Oct 17 '12 at 9:51
subfolders is perfect, that's what I would prefer, but am I able to restrict permissions for a student to only their folder? – at01 Oct 17 '12 at 16:13
Yes. Should be no problem. Just add folder name after bucket name in the access policy. Like: "arn:aws:s3:::bucket-name/folder-name/*". – mateuszzawisza Oct 19 '12 at 7:53
I've just wasted well over an hour experimenting with different policies. They don't make this intuitive at all. I want a policy where students can only access, read and write to a subfolder. At this point I'd settle for them being able to see other folders but not go in them. I've tried just about every possible policy and condition that makes any kind of sense. The above works but gives students way too many capabilities. – at01 Oct 19 '12 at 8:04
show 2 more comments
up vote 1 down vote

you should use Amazon IAM service http://aws.amazon.com/iam it will allow you to create subaccounts for your students and they will be able to publish they website the same way as you publish with your main account

share|improve this answer
up vote 0 down vote

If you're running linux, I wrote a script that does exactly this. It creates a web directory (chrooted) for a student and outputs their random password, and it also creates a MySQL account if you have that installed.

The username also becomes their subdomain. (sftp://johnny:randompass@server --> johnny.webclass.com --> /var/www/usr_data/johnny/www/ --> johnny@localhost for MySQL) all using the same password.

If you are using linux, I'd be more than happy to send you a copy of the script. Or, if other people request it, I'll post the source. (It is written in Perl and requires Apache).

share|improve this answer
Thank you for this, but I'm looking for students to be able to upload their files to Amazon's S3 service. – at01 Oct 15 '12 at 23:42
Understood, and I'd say next 'create different FTP accounts if you are allowed to' otherwise use the Amazon EC2 free-tier, which should suffice for your class(es). – ionFish Oct 15 '12 at 23:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.