# Serving files from S3

imgproxy can process files from S3 buckets. To use this feature do the following:

1. Set `IMGPROXY_USE_S3` environment variable as `true`;
2. [Setup credentials](#setup-credentials) to grant access to your bucket;
3. Use `s3://%bucket_name/%file_key` as the source image url.

### Setup credentials

There are three ways to specify your AWS credentials. The credentials need to be able to read from any of the buckets given in the source URLs.

#### Environment variables

You can specify AWS Acces Key ID and Secret Access Key by setting `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables.

``` bash
$ AWS_ACCESS_KEY_ID=my_access_key AWS_SECRET_ACCESS_KEY=my_secret_key imgproxy

# same for Docker
docker run -e AWS_ACCESS_KEY_ID=my_access_key -e AWS_SECRET_ACCESS_KEY=my_secret_key -it darthsim/imgproxy
```

It's recommended to use this way when you run dockerized imgproxy.

#### Shared credentials file

Create `.aws/credentials` file in your home directory with the following content:

```ini
[default]
aws_access_key_id = %access_key_id
aws_secret_access_key = %secret_access_key
```

#### IAM Roles for Amazon EC2 Instances

If you are running imgproxy on an Amazon EC2 instance, you can use the instance's [IAM role](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html) to get security credentials to make calls to AWS.

You can get more info about credentials in the [Configuring the AWS SDK for Go](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html) guide.