Delfs:
@Ali AK out not archived you question accidentally but here is some e detail:
You don’t need to attach Cognito roles or worry about the identity pool for this setup. FM BetterForms uses the server-side presigned URL model, which means your Business file signs requests before Uppy uploads to S3.
For that reason, you’ll need an IAM user with programmatic access, not Cognito. Here’s the process:
a. Create an IAM User
• Go to AWS → IAM → Users → Add user.
• Select Programmatic access.
• This generates the Access Key ID and Secret Access Key — those are what you enter in the Business file.
a. Attach a Policy to That User
• Create or attach a custom policy that allows only the actions you need on your S3 bucket (e.g., s3:PutObject, s3:AbortMultipartUpload, s3:ListMultipartUploadParts).
• Scope it tightly to your bucket and a prefix if possible, for example:
arn:aws:s3:::your-bucket/uploads/*
- Configure the Bucket
• Add a CORS policy on the bucket so browsers can PUT/POST directly after you presign a URL.
a. How it Works at Runtime
• The Business file uses the IAM user’s keys to generate a presigned URL.
• That URL is returned to Uppy in the browser.
• The browser uploads directly to S3 using that URL.
So to answer your direct question:
The accessKey and secretAccessKey come from an IAM user you create in AWS with programmatic access. You do not attach a Cognito role to it. Cognito isn’t used in this flow.
Ali AK:
ok great. its working now
Ali AK:
the only issue is with the web viewer in filemaker, it is not showing the image from the s3 bucket, even though I take the signed URL and put it in my browser its working fine, but not previewing in the web viewer. Any ideas?
Jason Wood:
Probably extra URL encoding in the web viewer config.
Ali AK:
That did the trick. Thanks Jason.