S3Proxy on Ubuntu 24.04 LTS
by cloudimg
S3 compatible object storage endpoint, SigV4 authenticated and secure on first boot
S3Proxy is an open source Java application that implements the Amazon S3 API and proxies requests to a storage backend. This cloudimg image configures the local filesystem backend, so a plain virtual machine and its dedicated data disk become an S3 compatible object storage endpoint: point any S3 SDK, the AWS CLI, s3cmd, rclone, restic or Veeam at it and read and write buckets and objects exactly as you would against Amazon S3, entirely within your own subscription. It runs S3Proxy 3.3.0 from the official release on the OpenJDK 17 runtime, under systemd as an unprivileged service user.
The gateway binds to loopback and is exposed through an nginx reverse proxy that terminates TLS on port 443, so the S3 API is reachable securely over HTTPS with a certificate generated per virtual machine on first boot. S3Proxy is headless: there is no web interface, so you operate it with any standard S3 client, and the AWS CLI is preinstalled so you can create buckets and read and write objects from the VM immediately. Bucket and object data lives on a dedicated data disk.
Security is built in. S3Proxy can be run with authorization disabled, which serves an open, anonymous endpoint; this image closes that gap by requiring AWS Signature Version 4 on every request. On the first boot of every VM a unique access key and secret key are generated, written into the gateway configuration and recorded in a root only file, and the service is configured to refuse to start until a key pair is present. As a result an unsigned or wrong key request is rejected, no two instances share a credential, and no known credential is ever baked into the image.
S3Proxy is distributed under the Apache License 2.0, free and open source with no per CPU or per deployment fee. cloudimg is not affiliated with or endorsed by the S3Proxy project or Amazon; S3 and Amazon S3 are marks of Amazon, and S3Proxy is a mark of its owner. cloudimg provides packaging, systemd hardening, the secure by default SigV4 configuration, per instance credential automation, TLS termination, security patching, and 24/7 support with a guaranteed 24 hour response SLA.