--- title: "Deploy AWS S3 Public Proxy" description: "Deploy and Host AWS S3 Public Proxy with Railway" category: "Automation" url: https://railway.com/deploy/aws-s3-public-proxy --- # Deploy AWS S3 Public Proxy Deploy and Host AWS S3 Public Proxy with Railway **[Deploy AWS S3 Public Proxy on Railway](https://railway.com/template/aws-s3-public-proxy)** - **Creator:** fournyp's Projects - **Category:** Automation - **Total deploys:** 2 ## Template content ### AWS S3 Public Proxy https://raw.githubusercontent.com/FournyP/aws-s3-public-proxy-railway-template/main/icon.svg - **Source:** FournyP/aws-s3-public-proxy-railway-template - **Health check:** /health - **Public domain:** Yes ## Documentation ![AWS S3 Public Proxy logo](https://raw.githubusercontent.com/FournyP/aws-s3-public-proxy-railway-template/main/icon.svg) # Deploy and Host AWS S3 Public Proxy on Railway AWS S3 Public Proxy is a tiny Go HTTP server that publicly serves read-only objects from a private S3-compatible bucket. It accepts `GET /` from anonymous callers and streams the object bytes back with a `200` response — no presigned URLs, no redirects, and no way to list, upload, or delete. ## About Hosting AWS S3 Public Proxy Railway Buckets (and most S3-compatible providers) are private by default — clients can't fetch objects without valid SigV4-signed credentials, which you never want to ship to a browser or a mobile app. This template runs a minimal Go proxy that holds the credentials server-side, accepts only `GET`/`HEAD` requests, and streams the bytes through. Stable URLs (`https:///path/to/file.pdf`) map 1:1 to S3 keys and are safe to share, bookmark, or put behind a CDN. ## Common Use Cases - Serving public assets (images, PDFs, downloads) from a private Railway Bucket to a frontend - Exposing a subset of bucket content to non-browser clients (mobile apps, curl, server-side fetchers) where 302 redirects are awkward - Putting a CDN (Cloudflare, Bunny, CloudFront) in front of a private bucket without exposing credentials - Giving teammates a stable, shareable URL to a file without generating a presigned link ## Dependencies for AWS S3 Public Proxy Hosting The template ships the Go proxy and its Dockerfile. You bring the storage: attach a Railway Bucket after deploy, or point the proxy at any external S3-compatible provider. ### Deployment Dependencies - Credentials for the target S3-compatible storage (access key, secret, endpoint, region, bucket name). ## Implementation Details ### Architecture Components This template deploys a single service: - **Proxy**: a ~10 MB Go binary running on a distroless, non-root container. Accepts only `GET` and `HEAD`; returns `405` for every other method. A `GET /health` endpoint is exposed unauthenticated for Railway healthchecks. ### Request Flow ``` anonymous client ──GET /path/to/file──► proxy (public) ──SigV4──► S3 bucket (private) │ ▼ 200 + file bytes ``` The proxy signs each upstream request with the server-side credentials, then streams the response body straight through. `Content-Type`, `Content-Length`, `ETag`, and `Last-Modified` are forwarded, and `If-None-Match` / `If-Match` headers are passed upstream so CDNs and clients can cache efficiently. ### Security Model - **Read-only by design.** `PUT`, `POST`, `DELETE`, and any other non-GET/HEAD verbs return `405`. - **No listing.** There is no endpoint that enumerates keys — callers must already know the object path. - **Credentials stay server-side.** Clients never see S3 credentials, signed URLs, or the upstream endpoint. - **Public by design.** Anyone who knows a key can fetch the file. Do not point this at a bucket that holds sensitive objects. ### Service Configuration - **Endpoint**: `https:///`. - **Storage**: set `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_S3_BUCKET_NAME`, `AWS_ENDPOINT_URL`, and `AWS_DEFAULT_REGION` on the service. For a Railway Bucket, use reference variables against the bucket's credentials. - **Caching**: tune `CACHE_CONTROL` (default `public, max-age=300`) to match the lifetime of your objects. ## License Information MIT. ## Why Deploy AWS S3 Public Proxy on Railway? The read-only enforcement, SigV4 signing, conditional-request forwarding, and distroless packaging are all pre-configured — giving a frontend or public client safe read access to a private bucket is a one-click deploy instead of a bespoke Go service or nginx + signing-module project. ## Notes - Source repo: https://github.com/FournyP/aws-s3-public-proxy-railway-template - Designed to pair with a Railway Bucket, but works with any S3-compatible provider (AWS S3, MinIO, Cloudflare R2, Backblaze B2, Tigris). ## Similar templates - [N8N Main + Worker](https://railway.com/deploy/n8n-main-worker) — Deploy and Host N8N with Inactive worker. - [Evolution API with n8n](https://railway.com/deploy/evolution-api-with-n8n) — [Jul'26] WhatsApp automation platform using Evolution API, n8n & PostgreSQL - [Postgres Backup](https://railway.com/deploy/postgres-s3-backups) — Cron-based PostgreSQL backup to bucket storage Open this page in a browser: https://railway.com/deploy/aws-s3-public-proxy