# Configure an S3 compatible object storage provider for uploads
**URL:** https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916
**Category:** Self-Hosting
**Tags:** cdn, configuring, how-to, reference
**Created:** [22 april 2020 om 22:37 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916 "2020-04-22T22:37:37Z")
**Posts on this page:** 20
**Page:** 2
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [11 oktober 2021 om 21:38 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/248 "2021-10-11T21:38:53Z")
It’s set in the example configuration block for Vultr in the OP. Copy and paste into your app.yml and adjust the necessary fields.
---
### Author:  [@Zup](https://meta.discourse.org/u/Zup)
#### Post date: [11 oktober 2021 om 21:40 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/249 "2021-10-11T21:40:40Z")
Thanks, I missed this bit:
> [@Falco](#):
>
> Choose your provider from the list below and add these settings to the `env` section of your app.yml file, adjusting the values accordingly:
---
### Author:  [@Zup](https://meta.discourse.org/u/Zup)
#### Post date: [14 oktober 2021 om 00:24 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/250 "2021-10-14T00:24:32Z")
This isn’t going smoothly for me, sorry to reply so many times.
> [@Falco](#):
>
> Choose your provider from the list below and add these settings to the `env` section of your app.yml file, adjusting the values accordingly:
>
> ### AWS S3
>
> What we officially support and use internally. Their CDN offering Cloudfront also works to front the bucket files. See [Setting up file and image uploads to S3](https://meta.discourse.org/t/setting-up-file-and-image-uploads-to-s3/7229) for how to configure the permissions properly.
>
> ```plaintext
> DISCOURSE_USE_S3: true
> DISCOURSE_S3_REGION: us-west-1
> DISCOURSE_S3_ACCESS_KEY_ID: myaccesskey
> DISCOURSE_S3_SECRET_ACCESS_KEY: mysecretkey
> DISCOURSE_S3_CDN_URL: https://falcoland-files-cdn.falco.dev
> DISCOURSE_S3_BUCKET: falcoland-files
> DISCOURSE_S3_BACKUP_BUCKET: falcoland-files/backups
> DISCOURSE_BACKUP_LOCATION: s3
>
> ```
If I do the above, should I ignore the admin panel settings for s3 and backups?
> [@Set up file and image uploads to S3](https://meta.discourse.org/t/set-up-file-and-image-uploads-to-s3/7229/1):
>
> Now that you’ve properly set up S3, the final step is to configure your Discourse forum. These instructions should work, but **the preferred method is to use environment variables and a CDN as described in [Using Object Storage for Uploads (S3 & Clones)](https://meta.discourse.org/t/using-object-storage-for-uploads-s3-clones/148916).**
>
> Make sure you’re logged in with an administrator account and go the **Settings** section in the admin panel.
>
> Type in “S3” in the textbox on the right to display only the relevant settings:
>
> 
Or should admin panel settings be configured as well?
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [14 oktober 2021 om 04:05 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/251 "2021-10-14T04:05:51Z")
You just need to follow this guide here in the OP and you will get a functional object storage configuration.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [14 oktober 2021 om 09:06 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/252 "2021-10-14T09:06:51Z")
Setting those variables makes them unavailable from the UX. You must set them as described here rather than the ux.
---
### Author:  [@Zup](https://meta.discourse.org/u/Zup)
#### Post date: [16 oktober 2021 om 22:40 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/253 "2021-10-16T22:40:02Z")
I think it’s (mostly?) working now, but is this `content security policy script src` safe?
I’m using AWS for two S3 containers (for uploads & backups), and two CloudFront CDNs (for files & assets). When I use my own CNAMEs for the CloudFront CDNs, I get a bunch of script-src network errors in my browser when loading Discourse. No more errors after adding those entires to my CSP.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [16 oktober 2021 om 23:29 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/254 "2021-10-16T23:29:00Z")
> [@Zup](#):
>
> When I use my own CNAMEs for the CloudFront CDNs, I get a bu
Are those the urls you put in the env variables described in the OP? And are they https?
---
### Author:  [@Zup](https://meta.discourse.org/u/Zup)
#### Post date: [16 oktober 2021 om 23:42 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/255 "2021-10-16T23:42:28Z")
Yes, I don’t have script-src warnings when I put the two [d23whatever.cloudfront.net](http://d23whatever.cloudfront.net) URLs in the env variables. When I put my custom URLs, i.e. community-cdn.mydomain and files-cdn.mydomain, in the env variables, that’s the time I get these script-src warnings. And apparently the stripe js is still giving me this warning even though it’s in my `content security policy script src`.
---
### Author:  [@omarfilip](https://meta.discourse.org/u/omarfilip)
#### Post date: [12 november 2021 om 03:30 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/256 "2021-11-12T03:30:46Z")
I set up [S3 Uploads](https://meta.discourse.org/t/setting-up-file-and-image-uploads-to-s3/7229) and object storage as outlined here in the OP, but without a CDN.
For the DISCOURSE\_S3\_CDN\_URL variable, I have this:
`https://my-bucket-uploads.s3.dualstack.us-west-2.amazonaws.com`
All seems fine, including backups, however, in the console this error shows up when a reply to a post is started:
The request url in the error is actually a string of two urls which seems like the cause?
`https://mydiscourse.com/t/uploads-test-for-s3/79/https://my-bucket-uploads.s3.dualstack.us-west-2.amazonaws.com/assets/markdown-it-bundle-a7328b73d3e7b030770eab70f10bdb0af655b3d8fa929bc49f1ad04c4cdaa198.br.js`
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [12 november 2021 om 03:31 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/257 "2021-11-12T03:31:47Z")
> [@omarfilip](#):
>
> but without a CDN.
> [@Falco](#):
>
> When using object storage, you also need a CDN to serve what gets stored in the bucket
A CDN is mandatory for it to work correctly.
---
### Author:  [@unteem](https://meta.discourse.org/u/unteem)
#### Post date: [14 januari 2022 om 11:08 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/258 "2022-01-14T11:08:43Z")
I’m also in this situation with an object store configured (minio) but no CDN. Is it a use case that could be supported ?
From what I’m seeing so far in my tests there is only the `markdown-it-bundle` js file that is having issues as its pointing to the wrong URL - `DISCOURSE_HOSTNAME/DISCOURSE_S3_CDN_URL/assets/markdown-it-bundle-HASH.br.js`
It actually looks lit a bug for this one, if I set `DISCOURSE_CDN_URL` variable, it still points to the wrong URL in this form `DISCOURSE_HOSTNAME/DISCOURSE_CDN_URL/assets/markdown-it-bundle-HASH.br.js`
it should point to `DISCOURSE_S3_CDN_URL/assets/markdown-it-bundle-HASH.br.js`
Other js assets are pointing to the right URL ’
I guess from what you are saying I will have other issues that I have not identified yet. Maybe you can give me more info on what could go wrong ?
If I undestand it well, js assets are on the object store, stylesheets should be on a CDN. WIthout a CDN could the stylesheets be delivered by the app as usual ? (from what i’m seeing its the case)
Thanks for your help
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [14 januari 2022 om 14:42 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/259 "2022-01-14T14:42:07Z")
> [@unteem](#):
>
> but no CDN. Is it a use case that could be supported ?
That is not a supported use case per the OP:
> [@Falco](#):
>
> When using object storage, you also need a CDN to serve what gets stored in the bucket.
---
### Author:  [@quangmai911](https://meta.discourse.org/u/quangmai911)
#### Post date: [23 januari 2022 om 22:03 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/260 "2022-01-23T22:03:25Z")
Dear all,
I set up a new discourse server with Lightsail, using this guide for S3 uploads and backups [setting-up-file-and-image-uploads-to-s3](https://meta.discourse.org/t/setting-up-file-and-image-uploads-to-s3/7229)
After setup, I got the error shown “The bucket does not allow ACLs” on the screen when I upload an image
Here is my policy for S3:
```plaintext
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"s3:GetObjectVersionTagging",
"s3:CreateBucket",
"s3:GetObjectAcl",
"s3:GetBucketObjectLockConfiguration",
"s3:PutLifecycleConfiguration",
"s3:GetObjectVersionAcl",
"s3:PutObjectTagging",
"s3:DeleteObject",
"s3:DeleteObjectTagging",
"s3:GetBucketPolicyStatus",
"s3:GetObjectRetention",
"s3:GetBucketWebsite",
"s3:ListJobs",
"s3:DeleteObjectVersionTagging",
"s3:GetObjectLegalHold",
"s3:GetBucketNotification",
"s3:PutBucketCORS",
"s3:GetReplicationConfiguration",
"s3:ListMultipartUploadParts",
"s3:PutObject",
"s3:GetObject",
"s3:DescribeJob",
"s3:PutObjectVersionAcl",
"s3:GetAnalyticsConfiguration",
"s3:GetObjectVersionForReplication",
"s3:GetLifecycleConfiguration",
"s3:GetAccessPoint",
"s3:GetInventoryConfiguration",
"s3:GetBucketTagging",
"s3:GetBucketLogging",
"s3:ListBucketVersions",
"s3:ReplicateTags",
"s3:ListBucket",
"s3:GetAccelerateConfiguration",
"s3:GetBucketPolicy",
"s3:GetEncryptionConfiguration",
"s3:GetObjectVersionTorrent",
"s3:AbortMultipartUpload",
"s3:PutBucketTagging",
"s3:GetBucketRequestPayment",
"s3:GetAccessPointPolicyStatus",
"s3:GetObjectTagging",
"s3:GetMetricsConfiguration",
"s3:PutObjectAcl",
"s3:GetBucketPublicAccessBlock",
"s3:ListBucketMultipartUploads",
"s3:ListAccessPoints",
"s3:PutObjectVersionTagging",
"s3:GetBucketVersioning",
"s3:GetBucketAcl",
"s3:GetObjectTorrent",
"s3:GetAccountPublicAccessBlock",
"s3:ListAllMyBuckets",
"s3:GetBucketCORS",
"s3:GetBucketLocation",
"s3:GetAccessPointPolicy",
"s3:GetObjectVersion"
],
"Resource": [
"arn:aws:s3:::mybucket-upload",
"arn:aws:s3:::mybucket-upload/*",
"arn:aws:s3:::mybucket-backup",
"arn:aws:s3:::mybucket-backup/*"
]
}
]
}
```
And here is my setup public access for S3 bucket:
Would someone help me to solve this issue, please?
Thanks so much
Cheers,
Quang
---
### Author:  [@Zup](https://meta.discourse.org/u/Zup)
#### Post date: [10 maart 2022 om 13:49 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/261 "2022-03-10T13:49:06Z")
Should my staging site use the same S3 bucket as my production site?
---
### Author:  [@lucasbasquerotto](https://meta.discourse.org/u/lucasbasquerotto)
#### Post date: [10 maart 2022 om 19:22 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/262 "2022-03-10T19:22:43Z")
No, that would be very unsafe, and it could delete files that should still exist in the other environment and change files from the other environment (which could cause missing files, wrong files, and so on).
Both the buckets as well as the credentials should be different (and the staging credentials shouldn’t have access to the production bucket, specially regarding write and delete operations).
Maybe there’s a way using paths with different credentials for each path, but the chances of shooting your own foot are high, so I advise to use separate buckets.
---
### Author:  [@Zup](https://meta.discourse.org/u/Zup)
#### Post date: [10 maart 2022 om 21:49 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/263 "2022-03-10T21:49:46Z")
`DISCOURSE_CDN_URL` and `DISCOURSE_S3_CDN_URL` need to be separate as well?
---
### Author:  [@lucasbasquerotto](https://meta.discourse.org/u/lucasbasquerotto)
#### Post date: [11 maart 2022 om 12:34 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/264 "2022-03-11T12:34:25Z")
I assume so, because if your staging and production domains/urls are different (they are, aren’t they?), then `DISCOURSE_CDN_URL` (that ends up pointing to the CDN provider, which points to your website domain) is expected to be different for staging and production. The same logic applies to `DISCOURSE_S3_CDN_URL` (because different buckets should have different urls).
---
### Author:  [@cookieman768](https://meta.discourse.org/u/cookieman768)
#### Post date: [14 maart 2022 om 21:27 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/265 "2022-03-14T21:27:08Z")
Hey all, I’m pretty new to S3, so I’m not entirely sure how to phrase this, but I’ll try my best. So, I just switched to using S3 for uploads and backups and I have been using [Discourse Connect](https://meta.discourse.org/t/13045?silent=true) in order to allow for logins on other parts of my site, but now profile images don’t work. I believe this has to do with CORS policies, but I’m not sure where I could configure it. I would ideally want to whitelist it for `forum.domain.tld` and `domain.tld` - or a wildcard on all subdomains would work too. Is this something I would set in Discourse, or where exactly? I’m using Vultr object storage if that makes a difference.
---
### Author:  [@Zup](https://meta.discourse.org/u/Zup)
#### Post date: [20 maart 2022 om 01:00 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/266 "2022-03-20T01:00:36Z")
Can versioning be enabled on the `files` S3 bucket? Is AWS Backup the recommended way to backup S3 buckets for Discourse?
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [20 maart 2022 om 14:23 UTC](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/267 "2022-03-20T14:23:32Z")
> [@Zup](#):
>
> Can versioning be enabled on the `files` S3 bucket?
Yes.
> [@Zup](#):
>
> Is AWS Backup the recommended way to backup S3 buckets for Discourse?
Using versioning, or syncing to a different region are all good strategies.
[Vorige pagina](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916.md?page=1)
[Volgende pagina](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916.md?page=3)