In the AWS Console (opens in a new tab), navigate to the S3 Service (opens in a new tab) and create an S3 bucket

Add a bucket name and region. (You'll need to input these in the project creation modal on Y-Sweet Cloud.) By default, ACLs should be disabled. Public access should also be blocked.

Create a new access policy

To create a new access policy, click your username in the top corner, then Security Credentials in the dropdown, then click Policies in the sidebar under Access management.

On the Create policy page, switch to the JSON tab in the policy editor.

In the JSON tab, copy and paste the following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::YOUR_BUCKET_HERE/*",
                "arn:aws:s3:::YOUR_BUCKET_HERE"
            ]
        }
    ]
}

At the bottom of the page, click Next Step. Give your policy a name (for example, y-sweet-policy) and create the policy.

With this access policy, Y-Sweet Cloud will only have permissions to read and write your document data to this S3 bucket. It won't have access to any other S3 buckets or to any other AWS resources in your account.

Create a user that Y-Sweet can use to access your S3 bucket

In the sidebar under Access management, click create user.

Give your user a name (for example, y-sweet-user). Go to the next step.

Set permissions for the user.

Select Attach policies directly. Search for the policy that you just created and check the box next to it before creating the user.

Get an an access key.

Once you've created a user, you can click the user name and on the user page. Then click create access key.

It'll open a page called Access key best practices & alternatives. Choose the Other use case.

Copy the access key and secret you've just created into Y-Sweet's project creation form.

Make sure you also provide the bucket name and region. Then create your project. Y-Sweet Cloud will check that it can access the bucket you've created with the credentials you've provided before it creates the new project. If this validation step fails, double check that you've entered the correct values and try again.