Editorial illustration.
Originally published 16 June 2023; rewritten and reviewed on 15 October 2026.
Moving CMS media to object storage changes more than its location. Kentico needs to write files, CloudFront needs to retrieve them and visitors need the intended delivery URL. Those are separate access requirements, so I would design them separately.
Establish the storage and URL contract
Confirm the installed Kentico/Xperience version and its supported filesystem-provider configuration. Decide the bucket, object prefix, region and delivery hostname before moving existing media. Record which application paths will change and which URLs must remain stable.
The original walkthrough showed console steps from an older configuration. Its screenshots are retained as historical context, not instructions to reproduce every permission setting today.
Keep the S3 origin private where appropriate
AWS documents origin access control as a way to permit CloudFront to read an S3 origin without opening the bucket to direct public access. The application identity that uploads media should receive its own narrowly scoped permissions.
Do not disable public-access protections or create broad administrator keys merely because a delivery request initially fails. Trace the requesting identity, object path and relevant policy instead.
Migrate and test a representative set
Start with a small set containing images, documents and any formats the site actually serves. Verify upload, retrieval, deletion, cache behaviour and generated URLs from the CMS. Check content types and the treatment of private documents separately from public media.
Keep an inventory and rollback route while the move is in progress. A copied file is not yet a completed migration if the CMS still writes to the old location or a page points at an inaccessible URL.
The useful result is a clear chain of ownership: Kentico manages the file, the application has the permissions it needs and CloudFront serves the intended representation through a verified delivery path.
Related reading
- Uploading to Amazon S3 from C# with an Explicit Object Contract
- Downloading from S3 Without Turning Object Keys into an Access Policy
Images from the original article
The following images are retained as historical context; interfaces and configuration options may have changed.
