Docs / Spaces

Serve public files

5 minute read

A Public read bucket serves its files to anyone with the link, which suits product photos, images and downloads for a website. Listing the bucket still needs a key, so nobody can browse what is in it.

1. Make a bucket public

Create a bucket with Access set to Public read, or change an existing bucket from its settings. Access is set per bucket, so keep private files such as invoices and backups in a separate private bucket.

simplicloud spaces buckets create kora-media --access public-read
# or change an existing one
simplicloud spaces buckets update kora-media --access public-read

2. Link to a file

Each object has a stable address made of the endpoint, the bucket and the key. Use it directly in an img tag or a download link.

curl -I https://spaces.simplicloud.ai/kora-media/menu.jpg
# HTTP/2 200
# content-type: image/jpeg
# cache-control: public, max-age=86400

3. Set content type and caching

Browsers rely on the content type to show an image instead of downloading it. The AWS CLI guesses it from the extension; set it yourself for unusual files, and set a long cache time for files that never change.

aws --endpoint-url https://spaces.simplicloud.ai s3 cp ./build/assets s3://kora-media/assets \
  --recursive --cache-control "public, max-age=31536000, immutable"
aws --endpoint-url https://spaces.simplicloud.ai s3 cp ./catalogue.webp s3://kora-media/catalogue.webp \
  --content-type image/webp

4. Allow uploads from the browser (CORS)

If your frontend uploads straight to Spaces with presigned URLs, the bucket must allow your site's origin. Save the rules to a file and apply them with the S3 API.

{
  "CORSRules": [{
    "AllowedOrigins": ["https://korafoods.ng", "https://www.korafoods.ng"],
    "AllowedMethods": ["GET", "PUT"],
    "AllowedHeaders": ["*"],
    "MaxAgeSeconds": 3600
  }]
}
aws --endpoint-url https://spaces.simplicloud.ai \
  s3api put-bucket-cors --bucket kora-media --cors-configuration file://cors.json