Home / Setup / Amazon S3

Back up Android photos to Amazon S3 — step-by-step

Updated May 2026 · ~15 minutes

What you need

• An AWS account. Free tier covers 5 GB of S3 for the first 12 months at aws.amazon.com.
• Breazzy on Android 8.0+.
• About 15 minutes; AWS has more knobs than B2 or R2.

Step 1 — Create the S3 bucket

1. Sign into the AWS Console, open the S3 service.
2. Click Create bucket.
3. Bucket name: must be globally unique. Try yourname-breazzy-photos.
4. AWS Region: pick the one closest to you (us-east-1, eu-west-2, ap-southeast-2…). Note this — Breazzy needs it.
5. Object Ownership: ACLs disabled (Bucket owner enforced).
6. Block Public Access: leave Block all public access on.
7. Bucket Versioning: optional. Enabling protects against accidental deletes from your phone; doubles storage when files change.
8. Default encryption: SSE-S3 (Amazon S3 managed keys). Free, transparent.
9. Click Create bucket.

Step 2 — Create an IAM user for the phone

1. Open the IAM service, click Users → Create user.
2. Username: breazzy-phone.
3. Do not grant console access. Programmatic only.
4. Permissions: Attach policies directly → click Create policy in a new tab.

Step 3 — Attach a least-privilege policy

In the policy editor, paste this JSON, replacing your-bucket with your bucket name:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket", "s3:GetBucketLocation"],
      "Resource": "arn:aws:s3:::your-bucket"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::your-bucket/*"
    }
  ]
}

Name it breazzy-phone-policy, create. Back on the user creation tab, refresh the policies list, tick breazzy-phone-policy, click Next → Create user.

Step 4 — Generate access keys

1. Click the new breazzy-phone user → Security credentials tab → Create access key.
2. Use case: Application running outside AWS. Acknowledge the warning, click Next.
3. Description tag: breazzy-phone. Click Create access key.
4. Copy the Access key ID and Secret access key. AWS shows the secret exactly once.

Step 5 — Configure Breazzy and back up

1. Open Breazzy, Add destination, choose Amazon S3.
2. Fill in:
   • Region — the AWS region from step 1, e.g. us-east-1.
   • Access Key — from step 4.
   • Secret Key — from step 4.
   • Bucket — your bucket name.
3. Tap Test connection, then Save.
4. Pick albums, plug in the charger, connect to Wi-Fi, start backup.

Optional — Auto-tier to Glacier Instant Retrieval

Standard S3 at $23/TB/mo is overkill for photos you might look at once a year. Add a lifecycle rule to move objects to Glacier Instant Retrieval (~$4/TB/mo) after 30 days:

1. In the bucket, open Management → Lifecycle rules → Create lifecycle rule.
2. Name: photos-to-glacier-ir.
3. Apply to All objects in the bucket.
4. Lifecycle actions: Move current versions to Glacier Instant Retrieval after 30 days.
5. Create.

Glacier IR has millisecond retrieval like Standard, but charges $0.03/GB per retrieval. For a backup that you only download in emergencies, this is the cheapest tier worth using.

AWS-specific gotchas

• Region must match. If your bucket is in eu-west-2 and you tell Breazzy us-east-1, signatures fail. Double-check before saving.
• S3 egress is $0.09 per GB. Backup workloads almost never download in bulk, but if you ever do, AWS will bill you. Most painful provider on egress.
• Request costs. $0.005 per 1,000 PUTs. A 50,000-photo library costs about $0.25 total in upload request fees. One-off.
• Versioning amplifies storage. If you enable versioning and then edit metadata in the bucket, you accumulate old versions. Add a lifecycle rule to expire non-current versions after 90 days if you care about cost.
• MFA on the root account. Always. The IAM user above is scoped narrowly, but your root account holds the keys to everything. Enable MFA on it before going further.

Frequently asked