We use the official Docker hosting setup on AWS based on GitHub - aws-samples/aws-cdk-for-discourse: AWS CDK for Discourse · GitHub. The general CDN setup works fine, e.g. images are delivered fine via CDN URL. However the initial “32x32” request seems to go to the S3 bucket URL which yields a 403. [image] Did I miss a configuration bit or is it a bug?

I found the issue. I restored a backup from another system.

[image] Fabian Fischer: We use the official Docker hosting setup on AWS based on GitHub - aws-samples/aws-cdk-for-discourse: AWS CDK for Discourse. That’s not official, as it’s an AWS project using a bitnami image for Discourse which we explicitly do not recognize as an official standard install of Discourse, making this outside of the scope of installs that we support here. [image] Fabian Fischer: Did I miss a configuration bit or is it a bug? Not a bug as it’s not running the app the way we intend it to be ran, but it may be fixed with a config change. Maybe open an issue about this on the sample repository ?

The referenced project uses the official Docker image. [image] lib/ec2-nested-stack.ts main userData.addCommands( "sudo -s", "yum -y update", "yum -y install docker", "yum -y install git", "yum -y install jq", "amazon-linux-extras install -y postgresql13", "systemctl enable docker.service", "systemctl start docker.service", "systemctl status docker.service", "git clone https://github.com/discourse/discourse_docker.git /var/discourse", "cd /var/discourse", "chmod 700 containers", "aws s3 cp s3://" + props.backupBucket.bucketName + "/app.yml.template ./containers/app.yml.template", "aws s3 cp s3://" + props.backupBucket.bucketName + "/smtp_credentials_generate.py ./smtp_credentials_generate.py", "echo -e 'export DISCOURSE_DB_USERNAME=$(aws secretsmanager get-secret-value --region " + this.region + " --secret-id " + props.auroraServerlessV2SecretArn + " --query SecretString --output text | jq -r .username)' > discourse-env", "echo -e 'export DISCOURSE_DB_PASSWORD=$(aws secretsmanager get-secret-value --region " + this.region + " --secret-id " + props.auroraServerlessV2SecretArn + " --query SecretString --output text | jq -r .password)' >> discourse-env", "echo -e 'export DISCOURSE_DB_HOST=$(aws secretsmanager get-secret-value --region " + this.region + " --secret-id " + props.auroraServerlessV2SecretArn + " --query SecretString --output text | jq -r .host)' >> discourse-env", "echo -e 'export DISCOURSE_DB_NAME=$(aws secretsmanager get-secret-value --region " + this.region + " --secret-id " + props.auroraServerlessV2SecretArn + " --query SecretString --output text | jq -r .dbname)' >> discourse-env", "echo -e 'export DISCOURSE_DB_PORT=$(aws secretsmanager get-secret-value --region " + this.region + " --secret-id " + props.auroraServerlessV2SecretArn + " --query SecretString --output text | jq -r .port)' >> discourse-env", "echo -e 'export PGPASSWORD=$(aws secretsmanager get-secret-value --region " + this.region + " --secret-id " + props.auroraServerlessV2SecretArn + " --query SecretString --output text | jq -r .password)' >> discourse-env", No Bitnami - I would not have used that in the first place either :wink: I am going to dig into it and report an issue either there, or here.

[image] nodomain: The referenced project uses the official Docker image. No Bitnami - I would not have used that in the first place either :wink: Oh, sorry I went by what is written in the project README.md README.md?plain=1 main 1. [Amazon CloudFront](https://aws.amazon.com/cloudfront/) is used for CDN via S3 and the application load balancer 2. [Amazon Route 53](https://aws.amazon.com/route53/) holds the hosted zone for DNS management to create verified outbound email domains along with domain certificates 3. [Amazon S3](https://aws.amazon.com/route53/) holds user upload files and static assets in one bucket along with Discourse backups in another bucket 4. [AWS Certificate Manager](https://aws.amazon.com/certificate-manager/) is used to create a DNS validated certificate 5. [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) holds the initial setup credentials and created database credentials. 6. [Amazon Cogntio](https://aws.amazon.com/cognito/) user pools are used via OpenID 7. [Amazon SES](https://aws.amazon.com/ses/) handles outbound email notifications 8. [AWS Systems Manager](https://aws.amazon.com/systems-manager/) Session Manager is used to connect to internal instances for debugging purposes 9. [AWS Auto Scaling](https://aws.amazon.com/autoscaling/) will create the desired number of instances in the desired availability zones 10. [Amazon EC2](https://aws.amazon.com/pm/ec2/) instances are bootstrapped via a user data script which pulls down the latest stable version of Discourse and sets up the app.yml then launches the [Discourse docker image](https://hub.docker.com/r/bitnami/discourse). 11. [Amazon RDS](https://aws.amazon.com/rds/) Aurora serverless V2 Postgres database stores user details and posts 12. [Amazon ElastiCache for Redis](https://aws.amazon.com/elasticache/redis/) is used as a caching layer ## Requirements 1. Apache Maven 3.8.5 or greater installed 2. Java 11 or greater installed 3. AWS Cloud Development Kit (CDK) 1.120.0 or higher 4. Valid docker login credentials 5. A domain name hosted by Route53 which is used to 1. Create a subdomain for discourse [image] nodomain: I am going to dig into it and report an issue either there Good luck. Please update here if you find any clues.

Pull request for README incoming :wink:

Somehow it used the s3 URL for the default Discourse system user avatar image. I did not spend time fixing it because I am still in progress of regularly recreating the environments due to some testing activities.

403 forbidden for thumbnails on s3 when running with CDN

Product Support Self-hosting

nodomain April 26, 2023, 8:48pm 5

Pull request for README incoming

Topic		Replies	Views
Issues with AWS CDN and S3 Self-hosting cdn , s3	22	1313	December 30, 2025
Unable to setup S3 bucket Self-hosting uploads , s3	11	726	January 12, 2025
What are the right settings to use S3 bucket (with non-Amazon URL)? Self-hosting	19	5475	August 25, 2020
User avatars not in S3 but served via discourse_cdn_url Development	2	574	August 14, 2020
Want to understand s3_cdn_url files setting Product Support	6	2908	June 27, 2016

403 forbidden for thumbnails on s3 when running with CDN

Related topics