Sign in to AWS Console

• Navigate to AWS Console
• Sign in with your root account or IAM user with admin privileges

Navigate to S3 Service

• Search for "S3" in the services search bar
• Click on "S3" to open the S3 console

Create a New Bucket

• Click the orange "Create bucket" button
• Enter bucket name: vyral-uploads-production (must be globally unique)
• If name is taken, try: vyral-uploads-yourcompany or vyral-prod-randomstring

Configure Region

• Select AWS Region closest to your users for better performance
• Recommended regions:
  • US East (N. Virginia): us-east-1 - Default, cheapest
  • US West (Oregon): us-west-2 - West Coast USA
  • EU (Ireland): eu-west-1 - Europe
  • Asia Pacific (Singapore): ap-southeast-1 - Southeast Asia

Configure Object Ownership

• Select "ACLs enabled"
• Choose "Bucket owner preferred"
• This allows you to manage object permissions via ACLs

Configure Public Access Settings

• Uncheck "Block all public access"
• Check the acknowledgment box
• Individual blocks to uncheck:
  • ✗ Block public access to buckets and objects granted through new access control lists (ACLs)
  • ✗ Block public access to buckets and objects granted through any access control lists (ACLs)
  • ✗ Block public access to buckets and objects granted through new public bucket or access point policies
  • ✗ Block public and cross-account access to buckets and objects through any public bucket or access point policies

Configure Bucket Versioning

• Keep "Disable" selected (unless you need version history)
• Versioning increases storage costs

Configure Encryption

• Enable "Server-side encryption"
• Choose "Amazon S3 managed keys (SSE-S3)"
• Keep "Enable Bucket Key" checked for cost optimization

Review and Create

• Review all settings
• Click "Create bucket"

Open Bucket Settings

• Click on your newly created bucket name
• Navigate to the "Permissions" tab

Edit Bucket Policy

• Scroll to "Bucket policy" section
• Click "Edit"

Add Public Read Policy

• Paste the following policy (replace vyral-uploads-production with your bucket name):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::vyral-uploads-production/*"
    },
    {
      "Sid": "AllowPublicListBucket",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::vyral-uploads-production",
      "Condition": {
        "StringLike": {
          "s3:prefix": ["public/*", "images/*", "videos/*"]
        }
      }
    }
  ]
}

Save Changes

• Click "Save changes"
• Confirm the public access warning

Navigate to CORS Configuration

• In bucket Permissions tab
• Scroll to "Cross-origin resource sharing (CORS)"
• Click "Edit"

Add CORS Rules

[
  {
    "AllowedHeaders": ["*"],
    "AllowedMethods": ["GET", "POST", "PUT", "DELETE", "HEAD"],
    "AllowedOrigins": ["*"],
    "ExposeHeaders": ["ETag", "x-amz-server-side-encryption", "x-amz-request-id", "x-amz-id-2"],
    "MaxAgeSeconds": 3000
  }
]

Note: For production, replace "*" in AllowedOrigins with your actual domain

Save CORS Configuration

• Click "Save changes"

Navigate to IAM Service

• Go to AWS Console home
• Search for "IAM" and click on it
• Click "Users" in the left sidebar

Create New User

• Click "Create user"
• User name: vyral-s3-user
• Click "Next"

Set Permissions - Create Policy First

• Select "Attach policies directly"
• Click "Create policy"
• This opens a new tab

Create Custom Policy

• In the new tab, select "JSON" editor
• Paste this comprehensive policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3BucketOperations",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:GetBucketVersioning",
        "s3:GetBucketAcl",
        "s3:GetBucketCORS",
        "s3:GetBucketPolicy",
        "s3:GetBucketPolicyStatus",
        "s3:GetBucketPublicAccessBlock",
        "s3:GetBucketWebsite",
        "s3:ListBucketVersions",
        "s3:ListBucketMultipartUploads"
      ],
      "Resource": "arn:aws:s3:::vyral-uploads-production"
    },
    {
      "Sid": "AllowS3ObjectOperations",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:PutObjectAcl",
        "s3:GetObject",
        "s3:GetObjectAcl",
        "s3:GetObjectVersion",
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "s3:ListMultipartUploadParts",
        "s3:AbortMultipartUpload",
        "s3:RestoreObject",
        "s3:GetObjectMetadata",
        "s3:GetObjectVersionMetadata",
        "s3:PutObjectRetention",
        "s3:GetObjectRetention",
        "s3:PutObjectLegalHold",
        "s3:GetObjectLegalHold",
        "s3:GetObjectTagging",
        "s3:PutObjectTagging",
        "s3:DeleteObjectTagging"
      ],
      "Resource": "arn:aws:s3:::vyral-uploads-production/*"
    },
    {
      "Sid": "AllowCloudFrontInvalidation",
      "Effect": "Allow",
      "Action": [
        "cloudfront:CreateInvalidation",
        "cloudfront:GetInvalidation",
        "cloudfront:ListInvalidations"
      ],
      "Resource": "*"
    }
  ]
}

Replace vyral-uploads-production with your actual bucket name

Name and Create Policy

• Click "Next"
• Policy name: VyralS3FullAccess
• Description: "Full access to Vyral S3 bucket for application use"
• Click "Create policy"
• Close this tab and return to the user creation tab

Attach Policy to User

• Back in the user creation tab, click the refresh button
• Search for VyralS3FullAccess
• Check the box next to your policy
• Click "Next"

Review and Create User

• Review the user details
• Click "Create user"

Create Access Keys

• Click on the newly created user name
• Go to "Security credentials" tab
• Scroll to "Access keys" section
• Click "Create access key"

Select Use Case

• Select "Application running outside AWS"
• Check the confirmation box
• Click "Next"

Set Description Tag

• Add description: "Vyral application S3 access"
• Click "Create access key"

Save Credentials

• IMPORTANT: Save these credentials securely, you won't see them again!
• Access key ID: AKIA... (20 characters)
• Secret access key: ... (40 characters)
• Click "Download .csv file" for backup
• Click "Done"

Enable ACLs on Bucket

• Go to your S3 bucket
• Click "Permissions" tab
• Find "Object Ownership" section
• Click "Edit"

Configure Object Ownership

• Select "ACLs enabled"
• Choose "Bucket owner preferred"
• Click "Save changes"

Set Default ACLs for Uploads In your application code, set ACLs when uploading:

const AWS = require('aws-sdk');
const s3 = new AWS.S3({
  accessKeyId: process.env.AWS_ACCESS_KEY_ID,
  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
  region: process.env.AWS_REGION
});

// Upload with public-read ACL
const uploadParams = {
  Bucket: 'vyral-uploads-production',
  Key: 'path/to/file.jpg',
  Body: fileContent,
  ACL: 'public-read', // Makes file publicly accessible
  ContentType: 'image/jpeg',
  CacheControl: 'max-age=31536000', // 1 year cache
  Metadata: {
    'uploaded-by': userId,
    'upload-date': new Date().toISOString()
  }
};

s3.upload(uploadParams, (err, data) => {
  if (err) console.error('Upload failed:', err);
  else console.log('Upload successful:', data.Location);
});

ACL Options Explained

• private: Owner has full control (default)
• public-read: Everyone can read, owner can write
• public-read-write: Everyone can read and write (not recommended)
• authenticated-read: AWS authenticated users can read
• aws-exec-read: Amazon EC2 gets read access
• bucket-owner-read: Bucket owner gets read access
• bucket-owner-full-control: Bucket owner gets full control

Navigate to CloudFront

• Go to AWS Console
• Search for "CloudFront"
• Click "Create Distribution"

Configure Origin

• Origin Domain: Select your S3 bucket from dropdown or enter vyral-uploads-production.s3.amazonaws.com
• Origin Path: Leave empty
• Name: Auto-filled
• S3 bucket access: "Yes use OAI (legacy)" for private bucket or "Don't use OAI" for public
• If using OAI:
  • Create new OAI
  • Update bucket policy: Yes

Default Cache Behavior Settings

• Path Pattern: Default (*)
• Compress objects automatically: Yes
• Viewer Protocol Policy: Redirect HTTP to HTTPS
• Allowed HTTP Methods: GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE
• Restrict viewer access: No

Cache Key and Origin Requests

• Cache policy: CachingOptimized (Recommended)
• Origin request policy: CORS-S3Origin
• Response headers policy: SimpleCORS

Distribution Settings

• Price Class: Use all edge locations (best performance)
• AWS WAF web ACL: None (unless you need DDoS protection)
• Alternate domain name (CNAME): Add cdn.yourdomain.com if you have SSL cert
• Custom SSL certificate: Select from ACM or import
• Security policy: TLSv1.2_2021 (Recommended)
• Supported HTTP versions: HTTP/2, HTTP/1.1, HTTP/1.0
• Standard logging: Off (or configure S3 bucket for logs)
• IPv6: Enabled

Create Distribution

• Review settings
• Click "Create distribution"
• Wait 15-20 minutes for deployment
• Note the CloudFront domain: d1234abcd.cloudfront.net

Navigate to Admin Panel

• Go to your Vyral admin dashboard
• Navigate to Settings → Storage Configuration

Enter S3 Configuration

{
  "provider": "s3",
  "s3Config": {
    "accessKey": "AKIA...",
    "secretKey": "your-secret-key-here",
    "bucket": "vyral-uploads-production",
    "region": "us-east-1",
    "endpoint": "https://s3.amazonaws.com",
    "cdnUrl": "https://d1234abcd.cloudfront.net",
    "forcePathStyle": false,
    "signatureVersion": "v4"
  }
}

Test Configuration

• Click "Test Connection"
• Try uploading a test file
• Verify file is accessible via CDN URL

Navigate to Bucket Management

• Go to S3 bucket
• Click "Management" tab
• Click "Create lifecycle rule"

Configure Rule for Old Files

• Rule name: archive-old-content
• Status: Enabled
• Rule scope: Apply to all objects

Add Transitions

{
  "Rules": [{
    "Id": "ArchiveOldContent",
    "Status": "Enabled",
    "Transitions": [
      {
        "Days": 30,
        "StorageClass": "STANDARD_IA"
      },
      {
        "Days": 90,
        "StorageClass": "INTELLIGENT_TIERING"
      },
      {
        "Days": 180,
        "StorageClass": "GLACIER_IR"
      }
    ],
    "NoncurrentVersionTransitions": [
      {
        "NoncurrentDays": 7,
        "StorageClass": "GLACIER_IR"
      }
    ],
    "AbortIncompleteMultipartUpload": {
      "DaysAfterInitiation": 7
    }
  }]
}

Configure Expiration

• Delete objects after: 365 days (optional)
• Delete expired object delete markers: Yes
• Delete incomplete multipart uploads: 7 days

Enable Transfer Acceleration

• Go to S3 bucket Properties tab
• Find "Transfer acceleration"
• Click "Edit"
• Select "Enabled"
• Save changes

Use Accelerated Endpoint

const s3 = new AWS.S3({
  accessKeyId: process.env.AWS_ACCESS_KEY_ID,
  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
  region: 'us-east-1',
  endpoint: 'https://vyral-uploads-production.s3-accelerate.amazonaws.com',
  useAccelerateEndpoint: true
});

Enable S3 Metrics

• Go to S3 bucket → Metrics tab
• Click "View additional charts in CloudWatch"
• Enable request metrics
• Configure daily storage metrics

Create Billing Alert

aws cloudwatch put-metric-alarm \
  --alarm-name s3-cost-alert \
  --alarm-description "Alert when S3 costs exceed $100" \
  --metric-name EstimatedCharges \
  --namespace AWS/Billing \
  --statistic Maximum \
  --period 86400 \
  --threshold 100 \
  --comparison-operator GreaterThanThreshold

Monitor Key Metrics

• BucketSizeBytes: Total storage used
• NumberOfObjects: Total object count
• AllRequests: API request count
• 4xxErrors: Client error rate
• 5xxErrors: Server error rate

Sign in to Cloudflare Dashboard

Navigate to R2 Object Storage

Click "Create bucket"

Configure bucket:

• Name: vyral-uploads
• Location: Automatic (global)
• Storage Class: Standard

Go to bucket Settings → Public Access

Enable "Public Access"

Configure domain:

• Use R2.dev subdomain: https://pub-xxx.r2.dev
• Or custom domain: cdn.yourdomain.com

For custom domain:

CNAME cdn.yourdomain.com bucket.r2.cloudflarestorage.com

Go to R2 → Manage R2 API Tokens

Click "Create API Token"

Configure token:

• Name: vyral-r2-token
• Permissions: Object Read & Write
• Bucket: Select your bucket
• TTL: Unlimited

Save credentials:

• Access Key ID
• Secret Access Key
• Endpoint URL

Sign in to Vultr Console

Go to Products → Object Storage

Click "Add Object Storage"

Select configuration:

• Cluster Location: Choose nearest region
• Label: vyral-storage
• Plan: Start with 250GB ($5/month)

Deploy the storage cluster

Access Object Storage dashboard

Click "Create Bucket"

Configure bucket:

• Name: vyral-uploads
• Access: Public read
• Versioning: Disabled

Go to Object Storage → Access Keys

Click "Create Access Key"

Save credentials:

• Access Key
• Secret Key
• Cluster ID (e.g., ewr1)

Sign up at Wasabi Console

Complete account verification

Choose primary region:

• US East 1 (N. Virginia)
• US East 2 (N. Virginia)
• US Central 1 (Texas)
• US West 1 (Oregon)
• EU Central 1 (Amsterdam)
• AP Northeast 1 (Tokyo)

Go to Buckets → Create Bucket

Configure bucket:

• Bucket Name: vyral-uploads
• Region: Your chosen region
• Versioning: Disabled
• Logging: Optional

Set bucket policy for public access:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "PublicReadGetObject",
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::vyral-uploads/*"
  }]
}

Go to Access Keys → Create New Access Key

Configure key:

• Name: vyral-storage-key
• Type: Full Access (or custom policy)

Download or copy:

• Access Key
• Secret Key

Go to Google Cloud Console

Create new project or select existing

Enable Cloud Storage API

Enable billing for the project

Navigate to Cloud Storage → Buckets

Click "Create Bucket"

Configure bucket:

• Name: vyral-uploads-prod
• Location Type: Multi-region (for redundancy)
• Location: US (or your preferred region)
• Storage Class: Standard
• Access Control: Uniform
• Encryption: Google-managed

Go to bucket Permissions tab

Click "Grant Access"

Add member:

• New principals: allUsers
• Role: Storage Object Viewer

Confirm public access warning

Go to IAM & Admin → Service Accounts

Click "Create Service Account"

Configure account:

• Name: vyral-storage-service
• ID: vyral-storage-service
• Description: Vyral platform storage access

Grant roles:

• Storage Object Admin
• Storage Object Creator

Create JSON key:

• Click on service account
• Keys tab → Add Key → Create new key
• Choose JSON format
• Download and secure the key file

Create Load Balancer with Cloud CDN

Configure backend bucket

Enable Cloud CDN

Set cache modes and TTL

Sign in to Azure Portal

Create a resource → Storage → Storage account

Configure basics:

• Subscription: Select your subscription
• Resource group: Create new or select existing
• Storage account name: vyralstorageaccount
• Region: Choose closest to users
• Performance: Standard
• Redundancy: LRS (or higher for production)

Configure advanced:

• Security: Enable secure transfer
• Data Lake Storage Gen2: Disabled
• Blob access tier: Hot
• Azure Files: Not needed

Review and create

Go to Storage Account → Containers

Click "+ Container"

Configure container:

• Name: uploads
• Public access level: Blob (anonymous read)

Go to Storage Account → Access keys

Copy:

• Storage account name
• Key1 or Key2
• Connection string

Go to Resource sharing (CORS)

Add CORS rule:

{
  "allowedOrigins": ["*"],
  "allowedMethods": ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
  "allowedHeaders": ["*"],
  "exposedHeaders": ["*"],
  "maxAgeInSeconds": 3600
}

Create CDN Profile:

• Go to CDN profiles → Create
• Choose pricing tier (Microsoft Standard recommended)

Create CDN Endpoint:

• Name: vyral-cdn
• Origin type: Storage
• Origin hostname: Select your storage account

Configure caching rules:

• Images: Cache for 7 days
• Videos: Cache for 30 days
• Documents: Cache for 1 day

Update CDN URL in config:

"cdnUrl": "https://vyral-cdn.azureedge.net/uploads"

Sign in to DigitalOcean Control Panel

Navigate to Spaces

Click "Create a Space"

Configure Space:

• Region: Choose closest to users
  • NYC3 (New York)
  • SFO3 (San Francisco)
  • AMS3 (Amsterdam)
  • SGP1 (Singapore)
  • FRA1 (Frankfurt)
• Enable CDN: Yes (recommended)
• Space name: vyral-uploads
• Project: Default or create new

Configure file listing:

• File Listing: Enable (for public access)
• CORS: Will configure later

Go to API → Spaces Keys

Click "Generate New Key"

Configure key:

• Name: vyral-spaces-key
• Expiry: Never

Save credentials:

• Access Key
• Secret Key

Go to your Space → Settings → CORS

Add CORS configuration:

<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration>
  <CORSRule>
    <AllowedOrigin>*</AllowedOrigin>
    <AllowedMethod>GET</AllowedMethod>
    <AllowedMethod>POST</AllowedMethod>
    <AllowedMethod>PUT</AllowedMethod>
    <AllowedMethod>DELETE</AllowedMethod>
    <AllowedHeader>*</AllowedHeader>
    <MaxAgeSeconds>3000</MaxAgeSeconds>
  </CORSRule>
</CORSConfiguration>

Go to Space → Settings → CDN

Add custom subdomain: cdn.yourdomain.com

Add CNAME record to your DNS:

CNAME cdn.yourdomain.com vyral-uploads.nyc3.cdn.digitaloceanspaces.com

Enable SSL certificate (automatic via Let's Encrypt)