Setting up BYOS

Before you start: connecting a bucket does not import, scan or change anything already stored in it — this page only covers connecting a bucket for new uploads.

1. Create an S3-compatible bucket

Create a bucket with your storage provider — Amazon S3 or another S3-compatible provider both work. Note the bucket name, the region, and the endpoint URL your provider gives you; PhotoLog asks for all three when you connect.

2. Create a scoped access credential

Create an access key for PhotoLog to use — do not reuse a key you use for anything else, and do not grant it account-wide S3 access. Attach a policy scoped to only the actions PhotoLog's connector needs, on only the bucket you are connecting:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PhotoLogBucketObjectAccess",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::your-bucket-name/*"
    }
  ]
}

Replace your-bucket-name with your bucket's name. This is a permissions baseline for PhotoLog's own connector, not a complete security policy for your bucket — you may want other protections on the bucket (for example, blocking public access) independent of what you grant PhotoLog. If you keep PhotoLog's uploads under a specific folder in your bucket, you can scope Resource further to that folder, for examplearn:aws:s3:::your-bucket-name/your-folder/*.

Deliberately left out: s3:ListBucket and any permission to read, change or delete the bucket itself (rather than the objects in it). Nothing in PhotoLog's connection or upload process lists or enumerates your bucket's contents, so this policy does not grant that ability.

One bucket setting worth adding

Files over 16 MB — most video — are uploaded in parts. If an upload is interrupted, those parts stay in your bucket, and S3 bills for them until something removes them. This policy does not grant permission to clean them up, deliberately: that permission is not needed for any other part of the process.

Add a lifecycle rule on the bucket to expire incomplete multipart uploads after a few days. In the S3 console it is Management → Lifecycle rules → Delete expired object delete markers or incomplete multipart uploads. It costs nothing, applies to every upload the bucket receives, and is worth setting whether or not you use it with PhotoLog.

3. Enter credentials in PhotoLog

Enter the access key, secret key, region, bucket name and endpoint URL in PhotoLog's studio settings. PhotoLog checks them immediately — writing a small test object, reading it back, and deleting it — before saving anything. If a step fails, PhotoLog tells you what to check (for example, that the endpoint is reachable, or that the credential has read as well as write access) without exposing the key or secret you entered.

4. Confirm connection

Once your credentials are saved, the studio's new uploads go to your bucket. What BYOS is and what connecting does and does not do is covered on the BYOS overview.

How we verified this

• The only S3 operations PhotoLog's connector performs against a customer-provided bucket are writing an object (uploads), reading an object back (viewing a photo, and the credential check), and deleting an object (removing a photo you delete, and cleaning up after the credential check) — nothing else (verified 2026-08-27)
• The credential check performed when you save your bucket details PUTs one small object, GETs it back and compares the bytes, then DELETEs it — proving write, read and delete access all work before your credentials are saved (verified 2026-08-27)
• Deleting a single PhotoLog-managed photo stored in your bucket is the only routine path that removes an object from your bucket, and it only ever removes an object PhotoLog itself wrote there (verified 2026-08-27)
• PhotoLog does not currently offer a way to turn BYOS mode off for a studio once your credentials are saved — plan your bucket before connecting (verified 2026-08-27)
• PhotoLog's connector has been run against Amazon S3 and against at least one other S3-compatible provider (Wasabi) — bucket creation steps are written provider-agnostically here rather than naming one provider's console (verified 2026-08-27)