I want students to publish their static websites to Amazon S3. But I can't have them all create AWS accounts because it requires their credit cards even for the free usage tier. I don't mind letting them use an account I setup (I'm happy to pay amazon's fees for usage too), but I need to give students their own directory and credentials to upload files. Is this possible with Amazon S3?

  • Why not just give them FTP like in the days of old?
    – Mikhail
    Commented Oct 16, 2012 at 10:16

3 Answers 3


Amazon IAM ( http://aws.amazon.com/iam/ ) service gives you the ability to create accounts for students with separate password/credentials and with access to only specified AWS resources.

You can create one account for all students there, or create a group called "Students" and assign all your students to that group.

After doing that you need to specify an access policy that permits them to upload files on specified bucket on S3.

Example of such policy can look like this:

 "Statement": [
  "Effect": "Allow",
  "Action": "s3:ListAllMyBuckets",
  "Resource": "arn:aws:s3:::*"
  "Effect": "Allow",
  "Action": "s3:*",
  "Resource": [

This policy will allow users to list all buckets and upload/delete files only in bucket called "bucket-name".

  • This seems perfect. Only that I have to create a new bucket for each student... I guess not a big deal.
    – at01
    Commented Oct 16, 2012 at 16:52
  • It depends on how many students you have. There is a limit for 100 buckets per account ( docs.amazonwebservices.com/AmazonS3/latest/dev/… ). You could also create one bucket and add subfolders. Not sure if this satisfies you. I would be like s3.page.address.com/student1/ , s3.page.address.com/student2/ etc... Commented Oct 17, 2012 at 9:51
  • subfolders is perfect, that's what I would prefer, but am I able to restrict permissions for a student to only their folder?
    – at01
    Commented Oct 17, 2012 at 16:13
  • Yes. Should be no problem. Just add folder name after bucket name in the access policy. Like: "arn:aws:s3:::bucket-name/folder-name/*". Commented Oct 19, 2012 at 7:53
  • I've just wasted well over an hour experimenting with different policies. They don't make this intuitive at all. I want a policy where students can only access, read and write to a subfolder. At this point I'd settle for them being able to see other folders but not go in them. I've tried just about every possible policy and condition that makes any kind of sense. The above works but gives students way too many capabilities.
    – at01
    Commented Oct 19, 2012 at 8:04

you should use Amazon IAM service http://aws.amazon.com/iam it will allow you to create subaccounts for your students and they will be able to publish they website the same way as you publish with your main account


If you're running linux, I wrote a script that does exactly this. It creates a web directory (chrooted) for a student and outputs their random password, and it also creates a MySQL account if you have that installed.

The username also becomes their subdomain. (sftp://johnny:randompass@server --> johnny.webclass.com --> /var/www/usr_data/johnny/www/ --> johnny@localhost for MySQL) all using the same password.

If you are using linux, I'd be more than happy to send you a copy of the script. Or, if other people request it, I'll post the source. (It is written in Perl and requires Apache).

  • Thank you for this, but I'm looking for students to be able to upload their files to Amazon's S3 service.
    – at01
    Commented Oct 15, 2012 at 23:42
  • Understood, and I'd say next 'create different FTP accounts if you are allowed to' otherwise use the Amazon EC2 free-tier, which should suffice for your class(es).
    – ionFish
    Commented Oct 15, 2012 at 23:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.