I am hosting some cloud optimised geotiffs in an S3 bucket to be used as a data store in geoserver. I am having trouble getting this working with a private bucket though, even after providing my AWS keys. I have tried various combinations of options but have had no luck. I can't see anywhere about using a private S3 bucket so wondering if this is actually possible, and if so if I am missing some step.

Steps taken:

  1. install extension
  2. add new data store and provide URL to S3 object
  3. Select Cloud Optimized GeoTIFF (COG)
  4. Select HTTP (I have also tried S3) as Range Reader settings
  5. Provide AWS keys with correct permissions to read from S3.

Currently just running locally and have tried setting environment variables etc.

  • You need to turn up the logging level to developer in the global settings page, and then make the request again. Then edit your question with the relevant part of the log file.
    – Ian Turton
    Commented Mar 15, 2023 at 13:33

1 Answer 1


The answer was simple: set permissions on the bucket.

"Version": "2012-10-17",
"Statement": [
        "Sid": "AddPerm",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::ACCOUNT:user/USER"
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::BUCKET/*"


I then had to provide the URL of the S3 object, select S3 as the Range Reader settings and provide AWS keys with correct permissions.

I was then able to load this externally in QGIS.

  • Can you explain this a bit more. I am also trying to access COG pushed on s3 emulator. I made my bucket private. When I try to access it trough python boto3 client I can download file. I also tried both ways on Geoserver, with http and s3 reader but in my s3 logs I can see that my request is rejected. What do you mean by setting permission on the bucket ?
    – Goran
    Commented Mar 18, 2023 at 15:18
  • @Goran, ok so I haven't used any python in this. Anytime you read from a private bucket you'll need an IAM user with permission to read from S3, and the permission on the bucket to allow that user to read it. If you go to the bucket view in the aws website, there is a 'Permissions' tab with a 'Bucket Policy' section where you can paste the above JSON in. Replace the capitalised words with your values and you should be ok. You'll have to provide the IAM user's keys in geoserver when creating the store. If you are using it locally with python then use aws configure to set up credentials
    – sobmortin
    Commented Mar 19, 2023 at 19:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.