Amazon S3 / MinIO Odoo Integration v.17

The tool depends on the external library 'boto3'. Install this library for your Odoo server through the command:

1. Turn on the option 'Amazon S3 Sync' (Cloud Storage > Configuration > Configuration). The optional add-on Amazon S3 Odoo Integration is required
2. Open the Amazon S3 Console: https://console.aws.amazon.com/s3/
3. Create a new bucket or choose an existing one. Copy the exact bucket name: it should be inserted in Odoo into the field 'Bucket'
4. Open the bucket details and copy its AWS Region. Insert it in Odoo into the field 'Region' (for example, eu-west-1 or us-east-1)
5. Open the AWS IAM Console: https://console.aws.amazon.com/iam/
6. Create a new IAM user or choose an existing technical user. This user should have full rights to list, read, create, write, copy, and delete objects within the selected bucket. You can select the full right admin, or create a new policy (see below)
7. In the IAM user form, open the tab 'Security credentials' and press 'Create access key'
8. On the page 'Access key best practices & alternatives', select the option Application running outside AWS. This is the correct option when your Odoo server connects to S3 by access key from outside AWS, from Odoo.sh, from your own server, or from another hosting provider. If your Odoo is installed on an AWS EC2 instance, you may instead select Application running on an AWS compute service, but the fields copied to Odoo are the same
9. Press 'Next'. On the next step, optionally enter a description tag such as Odoo S3 Sync, then press 'Create access key'
10. On the final AWS page, copy Access key or Access key ID into the Odoo field 'Access Key'
11. Copy Secret access key into the Odoo field 'Secret Key'. Important: AWS shows the secret key only once, so save it before closing the window
12. If you use an S3-compatible provider instead of AWS S3, copy the endpoint URL from that provider's admin panel and insert it into Odoo into the field 'Amazon S3 endpoint URL'. For example, MinIO often uses a URL like https://minio.example.com or http://localhost:9000; LocalStack commonly uses http://localhost:4566
13. Go to Odoo Cloud Storage > Configuration > Cloud Clients and press 'Create'
14. As a reference, introduce any name which would be clear to all users
15. As a Cloud client, choose 'Amazon S3'
16. As a Root folder name, enter a title that will be used as the parent S3 prefix for all synced folders. For example, 'Odoo' or 'OdooERP'
17. Fill in the fields 'Bucket', 'Region', 'Access Key', 'Secret Key', and, if needed, 'Amazon S3 endpoint URL' and addressing style
18. Choose whether Odoo should use temporary presigned URLs or public bucket/CDN URLs. For private buckets, keep presigned URLs enabled and set their lifetime in seconds
19. Press 'Confirm'. Odoo checks bucket access and creates or verifies the root folder prefix. Amazon S3 - Odoo synchronization is ready to be done
20. Apply the newly created cloud client to folder rules and/or manual folders which should be synced to that Amazon S3 bucket
21. Await the sync scheduled job to be started. For testing purposes only: trigger integration manually from Cloud Storage > Configuration > Configuration > the button 'Launch sync'.

Useful AWS documentation: creating an S3 bucket: https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html, managing IAM access keys: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html.

Bucket policy example

Amazon S3 has an important peculiarity: the URL shown in Odoo is always an Amazon-side link.

If Use Public URLs is enabled, Odoo saves a direct S3 object URL. This link works only if the related S3 bucket, prefix, object, CDN, or compatible endpoint is publicly readable. Otherwise, Amazon S3 will show AccessDenied, even if the user is logged in to the AWS console.

For public links, configure the bucket permissions in Amazon S3 and allow public read access for the Odoo prefix. Example bucket policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadOdooPrefix",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/Odoo/*"
    }
  ]
}

Replace YOUR_BUCKET_NAME with the real bucket name and Odoo/ with the selected root folder prefix. Also make sure that Amazon S3 Block public access settings do not block that bucket policy.

If Use Public URLs is disabled, Odoo saves AWS Console links to the related bucket object or prefix. Such links are useful for Amazon users: the person opening the link must be logged in to AWS and must have IAM access to that bucket object. If the user has no AWS access, Amazon will not open the file.

1. Prepare a running MinIO server
2. Open the MinIO Console
3. Create a new bucket or choose an existing one. Copy the exact bucket name: it should be inserted in Odoo into the field 'Bucket'
4. Create access credentials for Odoo. In MinIO, use an access key / secret key pair or a service account that has rights to list, read, create, write, copy, and delete objects within the selected bucket
5. Copy the MinIO Access Key into the Odoo field 'Access Key'
6. Copy the MinIO Secret Key into the Odoo field 'Secret Key'. Important: save the secret before closing the MinIO page if MinIO shows it only once
7. Copy the MinIO S3 API endpoint URL into Odoo into the field 'Amazon S3 endpoint URL'. For example, a local server usually uses http://localhost:9000, while a production server may use https://minio.example.com
8. Go to Odoo Cloud Storage > Configuration > Cloud Clients and press 'Create'
9. As a reference, introduce any name which would be clear to all users
10. As a Cloud client, choose 'MinIO'
11. As a Root folder name, enter a title that will be used as the parent MinIO object prefix for all synced folders. For example, 'Odoo' or 'OdooERP'
12. Fill in the fields 'Bucket', 'Access Key', 'Secret Key', and 'Amazon S3 endpoint URL'. The field 'Region' is optional for MinIO; if it is empty, Odoo uses us-east-1 for S3-compatible signing
13. Keep the addressing style as Path-style. This is the recommended option for MinIO endpoints, especially when the MinIO host does not provide bucket-specific DNS names
14. Choose whether Odoo should use direct public MinIO URLs. Enable 'Use Public URLs' only when the bucket, prefix, reverse proxy, or CDN is publicly readable. For private MinIO buckets, leave it disabled
15. Press 'Confirm'. Odoo checks bucket access and creates or verifies the root folder prefix. MinIO - Odoo synchronization is ready to be done
16. Apply the newly created cloud client to folder rules and/or manual folders which should be synced to that MinIO bucket
17. Await the sync scheduled job to be started. For testing purposes only: trigger integration manually from Cloud Storage > Configuration > Configuration > the button 'Launch sync'.

Useful MinIO documentation: https://min.io/docs/minio/linux/administration/identity-access-management.html, https://min.io/docs/minio/linux/reference/minio-server/minio-server.html.