git-annex/ tips/ using Amazon S3

git-annex extends git's usual remotes with some special remotes, that are not git repositories. This way you can set up a remote using say, Amazon S3, and use git-annex to transfer files into the cloud.

First, export your Amazon AWS credentials:

    # export AWS_ACCESS_KEY_ID="08TJMT99S3511WOZEP91"
    # export AWS_SECRET_ACCESS_KEY="s3kr1t"

Now, create a gpg key, if you don't already have one. This will be used to encrypt everything stored in S3, for your privacy. Once you have a gpg key, run `gpg --list-secret-keys` to look up its key id, something like "2512E3C7"

Next, create the S3 remote, and describe it.

    # git annex initremote cloud type=S3 chunk=1MiB keyid=2512E3C7
    initremote cloud (encryption setup with gpg key C910D9222512E3C7) (checking bucket) (creating bucket in US) (gpg) ok
    # git annex describe cloud "at Amazon's US datacenter"
    describe cloud ok

The configuration for the S3 remote is stored in git. So to make another repository use the same S3 remote is easy:

    # export AWS_ACCESS_KEY_ID="08TJMT99S3511WOZEP91"
    # export AWS_SECRET_ACCESS_KEY="s3kr1t"
    # git pull laptop
    # git annex enableremote cloud
    enableremote cloud (gpg) (checking bucket) ok

Notice that to enable an existing S3 remote, you have to provide the Amazon AWS credentials because they were not stored in the repository. (It is possible to configure git-annex to do that, but not the default.)

## further reading

See S3 for details about configuring S3 remotes.

See public Amazon S3 remote for how to set up a Amazon S3 remote that can be used by the public, without them needing AWS credentials.

If you want to publish files to S3 so they can be accessed without using git-annex, see publishing your files to the public.

comment 9

Lemao, make sure you have pushed your git-annex branch to your central git repository.

When you clone that repo elsewhere, you can add the S3 remote by running `git annex enableremote cloud` (replace "cloud" with whatever name you originally picked when you used `git annex initremote` to set up the S3 remote in the first place.

git-annex stores the necessary configuration of the S3 remote on the git-annex branch.

Comment by http://joeyh.name/ — Tue Jul 22 18:11:47 2025
comment 8

I use github as my central git repository and I would like to use S3 to store large files with annex. Since the s3 remote in .git/config is not stored in github, how do I make sure I reconnect to the same s3 bucket in case I delete my local clone? Reinitializing the remote will create a completely new bucket.

I would also be a good idea to centralize git-annex folders inside a single bucket so I keep the global namespace under control and can narrow down the permissioning.

Comment by https://www.google.com/accounts/o8/id?id=AItOawkPIqJZ88VZEVqLhLOd1LMdYXcy6bAW9qE — Tue Jul 22 18:11:47 2025
How to publish your files to the public

I don't know if this is what Jack wanted, but you can upload your files to S3 and let them be accessible through a public URL.

First, go to (or create) the bucket you will use at S3 and add a public get policy to it:

       {
            "Version": "2008-10-17",
            "Statement": [
                {
                    "Sid": "AllowPublicRead",
                    "Effect": "Allow",
                    "Principal": {
                        "AWS": "*"
                    },
                    "Action": "s3:GetObject",
                    "Resource": "arn:aws:s3:::BUCKETNAME/*"
                }
            ]
        }

Then set up your special remote with the options `encryption=none`, `bucket='BUCKETNAME'` `chunk=0` (and any others you want).

Your files will be accessible through `http://BUCKETNAME.s3-website-LOCATION.amazonaws.com/KEY` where location is the one specified through the options `datacenter` and KEY is the SHA-SOMETHING hash of the file, created by git annex and accessible if you run `git annex lookupkey FILEPATH`.

This way you can share a link to each file you have at your S3 remote.

Comment by https://www.google.com/accounts/o8/id?id=AItOawmH7o6q2l99M-PQolOfbR3_i5B_jtTIcAE — Tue Jul 22 18:11:47 2025
comment 6

Jack, if you don't want to use encryption you can use `encryption=none` as documented here.

I'm not sure exactly what you're trying to do, but please note that you files won't be easily available on S3: they will be named as git-annex keys, with long and unreadable names such as "SHA256E-s6311--c7533fdd259d872793b7298cbb56a1912e80c52a845661b0b9ff391c65ee2abc.html" instead of "index.html".

Comment by http://schnouki.net/ — Tue Jul 22 18:11:47 2025
What if you do not want to encrypt?
Once use case for GIT with Amazon S3 is to maintain a web site on S3 you can easily update from a local machine. In that case you would not want to encrypt. Is encryption optional? This isn't clear from the instructions.
Comment by https://www.google.com/accounts/o8/id?id=AItOawkmN2ZZIdYNiFKmEH7rz4jMb6sYsx_dptA — Tue Jul 22 18:11:47 2025
comment 4

You can use `git annex enableremote` to change an existing remote's configuration. So this should work:

    # export AWS_ACCESS_KEY_ID="newRANDOMGOBBLDEYGOOK"
    # export AWS_SECRET_ACCESS_KEY="news3kr1t"
    # git annex enableremote cloud

Comment by http://joeyh.name/ — Tue Jul 22 18:11:47 2025
Altering AWS credentials
If I revoke old AWS credentials and create new ones, how would I inform git-annex of the change to `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`?
Comment by annexuser — Tue Jul 22 18:11:47 2025
comment 2
Thanks, I've fixed that. (You could have too.. this is a wiki ;)
Comment by http://joeyh.name/ — Tue Jul 22 18:11:47 2025
comment 16

You can also use the --fast option to make git-annex use less entropy when generating the encryption key. That's a little less secure, but probably still secure enough.

Comment by joey — Tue Jul 22 18:11:47 2025
The initremote command appears to hang due to low entropy

For me, the `git annex initremote amazon-s3 encryption=shared embedcreds=yes` [1] command hung for several minutes after printing

    initremote amazon-s3 (encryption setup)

Turns out the problem was that I was low on entropy. Figured this out by running

    gpg --gen-random 2

per this bug comment. According to this blog post a solution is to

    sudo aptitude install rng-tools
    sudo rngd -r /dev/urandom

The `git annex initremote` command had finished by the time I found that solution, but I verified that it made `gpg --gen-random 2` work.

System: Ubuntu 16.04 with Git Annex 5.20151208-1build1 installed via package manager.

[1] I'm using AWS credentials that are restricted to a specific bucket, so I'm not worried about the conjunction `encryption=shared` and `embedcreds=yes`.

Comment by NathanCollins — Tue Jul 22 18:11:47 2025
comment 14

@james, since your keyring apparenty contains your secret key, the problem may be in the configuration of your gpg agent or pinentry program. If the agent is unable to use pinentry for some reason, gpg will complain that the secret key is unavailable since it is unable to get the passphrase to unlock it.

I had a similar problem with gpg2 the other day: http://bugs.debian.org/791379

Comment by joey — Tue Jul 22 18:11:47 2025
enable s3 remote on clone

Hi, I am trying to enable access to my s3 area from a clone. I am running into this issue:

    $ git annex enableremote mys3
    enableremote mys3 (encryption update) (hybrid cipher with gpg key EA1CF14BD8467AFB) (gpg) gpg: decryption failed: secret key not available

    git-annex: user error (gpg ["--batch","--no-tty","--use-agent","--quiet","--trust-model","always","--decrypt"] exited 2)
    failed
    git-annex: enableremote: 1 failed

My gpg key is available :

    $ gpg -K EA1CF14BD8467AFB
    sec   4096R/D8467AFB 2010-10-25
    uid                  James Richardson (email) <james@jamestechnotes.com>
    uid                  James Richardson <james.richardson.jr@gmail.com>
    uid       [ revoked] James Richardson (list) <jr@jamesr.biz>
    uid       [ revoked] James Richardson (James Richardson) <james@jamesr.biz>
    ssb   4096R/F90CF7F0 2010-10-25
    ssb   4096R/005D609B 2010-10-26

I would expect this to pop up a dialog asking me for my passphrase, as it will when I run the gpg command from a term.

Any ideas?

Comment by james — Tue Jul 22 18:11:47 2025
RE: last comment

RE: my last comment

The reason I couldn't get it to work is because I didn't have proper read access to the bucket. My bad for not checking first but it would be great it there was a clearer error message from git-annex and/or a way to get more detailed information on the s3 extension (-d doesn't do much).

Regardless git-annex is pretty cool, thanks to all the maintainers for their hard work.

Comment by https://www.google.com/accounts/o8/id?id=AItOawn8d6WBPNtmyeANT-gjlN19QnCTQ0psRPs — Tue Jul 22 18:11:47 2025
comment 11

Even after enableremote I can't get from s3.

    get Docs.zip (from s3...)

      Unable to access these remotes: s3

      Try making some of these repositories available:
        02b4e373-02b1-42b9-8285-c353c047895c -- my laptop
        f287b4f7-4e5a-4734-bd6b-62b1f4498838 -- [s3]

      (Note that these git remotes have annex-ignore set: origin)
    failed
    git-annex: get: 1 failed

This is after all branches are pushed from my original repo. Any suggestions?

Comment by https://www.google.com/accounts/o8/id?id=AItOawn8d6WBPNtmyeANT-gjlN19QnCTQ0psRPs — Tue Jul 22 18:11:47 2025
comment 10
My bad. I didn't realize git annex creates a new branch. After I pushed it, the clone was able to enableremote and I was able to get the file.
Comment by https://www.google.com/accounts/o8/id?id=AItOawkPIqJZ88VZEVqLhLOd1LMdYXcy6bAW9qE — Tue Jul 22 18:11:47 2025
ANNEX_S3 vs AWS for keys
The instructions state ANNEX_S3_ACCESS_KEY_ID and ANNEX_SECRET_ACCESS_KEY but git-annex cannot connect with those constants. git-annex tells me to set both "AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY" instead, which works. This is with Xubuntu 12.04.
Comment by https://www.google.com/accounts/o8/id?id=AItOawnoUOqs_lbuWyZBqyU6unHgUduJwDDgiKY — Tue Jul 22 18:11:47 2025
Comments on this page are closed.