S3 Bucket Zipper (IIS)

1. Launch with at least t3.medium (2 vCPU / 4 GB) and 50 GB gp3 storage.
2. Security group: RDP (3389) from your own IP only; 80/443 from your clients. Never expose 3389 to 0.0.0.0/0.
3. IMDSv2 must be required (Metadata > Http tokens: required). Verify: $t = Invoke-RestMethod -Method Put -Uri http://169.254.169.254/latest/api/token -Headers @{"X-aws-ec2-metadata-token-ttl-seconds"="60"} Invoke-RestMethod -Uri http://169.254.169.254/latest/meta-data/instance-id -Headers @{"X-aws-ec2-metadata-token"=$t}
4. Connect by RDP (console > Connect > Get password, using your .pem; user Administrator).
5. IIS and the API start automatically. Check http://<public-ip>/ shows the welcome page and http://<public-ip>/v2/health returns healthy. If not, run iisreset /restart and read C:\inetpub\app\logs\log.txt.

Job status and shareable links are stored in MongoDB. Install MongoDB Community Server, set the service to Automatic and start it (Get-Service MongoDB). Keep it on localhost, no inbound rule for 27017. Different database? Edit dbconfig.mongo.tokenMongo in config.yaml (default mongodb://localhost:27017/zipperresults). Without MongoDB, /v2/streamzip returns 503 "link store unavailable".

Settings are optional and the file is watched, so saves apply within a second.

liveconfig: uselive: true # read public IP from instance metadata baseurl: "" # your DNS name or IP; required behind a load balancer usehttps: false # true when TLS terminates in front of the instance jwtconfig: jwtSecret: "replace-with-a-long-random-string" # CHANGE THIS: signs share links keyauthorization: usewebkey: false webkey: "replace-with-a-long-random-string"

baseurl and usehttps affect only /v2/streamzip links; presigned /v2/s3zip URLs come from S3. With usewebkey: true, clients send Authorization: Bearer <webkey> on POST. The public port comes from IIS web.config, not HOST_PORT. Restart with iisreset /restart after editing web.config or bindings.

None are baked in and IAM instance roles are not used. Send them per request (awsKey, awsSecret, awsToken, awsRegion, awsBucket) or set them once under awsconfig: (plus optional destawsconfig:). Grant only s3:GetObject, s3:PutObject, s3:ListBucket on the archived buckets.

curl -X POST http://<public-ip>/v2/s3zip \ -H "Content-Type: application/json" \ -d '{"awsKey":"AKIA...","awsSecret":"...","awsBucket":"my-bucket", "awsRegion":"us-east-1","filePaths":["folder/file.pdf"], "zipTo":"my-bucket/archives/out.zip","usePresignUrl":true}'

The reply has a zipID and a presigned URL; the /settings page on the instance documents the endpoints with live examples. Poll GET /v2/status?zipID=<id>; GET /v2/result?zipID=<id> waits for completion. Use POST /v2/streamzip for a shareable link instead of an S3 object.

Site root C:\inetpub\app; config config.yaml; logs logs\log.txt (tail: powershell -c "Get-Content C:\inetpub\app\logs\log.txt -Wait"); pages templates\ (reload on each request).

Errors are JSON with real status codes: 400 bad request or missing AWS credentials, 401 rejected credentials, 404 unknown zipID, 405 wrong method (start a zip with POST), 413 body over 2 MiB, 503 busy. Troubleshooting: 503 on /v2/streamzip means MongoDB is down; InvalidClientTokenId means a bad AWS key; AccessDenied means the key lacks S3 rights; wrong host in share links means set baseurl; Unknown in /v2/health means IMDSv2 is blocked.

Full documentation: https://docs.s3zipper.com/