How to create an AWS IAM user and S3 bucket

This guide shows you how you can set up an IAM user and S3 bucket in AWS, a prerequisite step for taking backups to S3 or configuring ClickHouse to store data on S3

Create an AWS IAM user

In this procedure, we’ll be creating a service account user, not a login user.

Log into the AWS IAM Management Console.
In the Users tab, select Create user

AWS IAM Management Console - Adding a new user

Enter a user-name

Select Next

Select Next

Select Create user

The user is now created. Click on the newly created user

Select Create access key

Select Application running outside AWS

Select Create access key

Download your access key and secret as a .csv for use later

Create an S3 bucket

In the S3 bucket section, select Create bucket

Enter a bucket name, leave other options default

Leave Block all Public Access enabled; public access isn’t needed.

Select Create Bucket at the bottom of the page

Select the link, copy the ARN, and save it for use when configuring the access policy for the bucket

Once the bucket has been created, find the new S3 bucket in the S3 buckets list and select the bucket name which will take you to the page shown below:

Select Create folder
Enter a folder name that will be the target for the ClickHouse S3 disk or backup and select Create folder at the bottom of the page

The folder should now be visible on the bucket list

Select the checkbox for the new folder and click on Copy URL. Save the URL for use in the ClickHouse storage configuration in the next section.

Select the Permissions tab and click on the Edit button in the Bucket Policy section

Add a bucket policy, example below

{
    "Version": "2012-10-17",
    "Id": "Policy123456",
    "Statement": [
        {
            "Sid": "abc123",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::782985192762:user/docs-s3-user"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::ch-docs-s3-bucket",
                "arn:aws:s3:::ch-docs-s3-bucket/*"
            ]
        }
    ]
}

Parameter	Description	Example Value
Version	Version of the policy interpreter, leave as-is	2012-10-17
Sid	User-defined policy id	abc123
Effect	Whether user requests will be allowed or denied	Allow
Principal	The accounts or user that will be allowed	arn:aws:iam::782985192762:user/docs-s3-user
Action	What operations are allowed on the bucket	s3:*
Resource	Which resources in the bucket will operations be allowed in	“arn:aws:s3:::ch-docs-s3-bucket”, “arn:aws:s3:::ch-docs-s3-bucket/*”

Save the policy configuration