'
Tasks: TOP => uploads:migrate_to_s3
```
At least one CDN checker shows [discourse-cdn.repealobbba.org](http://discourse-cdn.repealobbba.org) --\>Amazon CloudFront
and console still shows images and js files are being called from the CDN
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [December 11, 2025, 10:30am UTC](https://meta.discourse.org/t/issues-with-aws-cdn-and-s3/391132/6 "2025-12-11T10:30:03Z")
The assets are called from the cdn, but are they there? If not, are they in the bucket? Are they accessible from the bucket?
You likely have some uploads in a different bucket or something that keeps them from being in the expected place. If so, you’ll need to fix those by hand like it sats. You’ll need to access the console and see where they are on the upload record.
Does the upload assets task seem to be working? The throbber keeps running because the other assets are no loading.
---
### Author:  [@philh](https://meta.discourse.org/u/philh)
#### Post date: [December 11, 2025, 7:00pm UTC](https://meta.discourse.org/t/issues-with-aws-cdn-and-s3/391132/7 "2025-12-11T19:00:14Z")
Yes they are there, files are in the bucket as assets
Accessible: [https://repeal-obbba-discuss-uploads.s3.us-east-1.amazonaws.com/assets/logo-815195ae.png](https://repeal-obbba-discuss-uploads.s3.us-east-1.amazonaws.com/assets/logo-815195ae.png)
Only two buckets, uploads and backups. Backups are working fine.
rake s3:upload\_assets gave error:
rake aborted!
Aws::S3::Errors::AccessControlListNotSupported: The bucket does not allow ACLs (Aws::S3::Errors::AccessControlListNotSupported)
Switched to ACLs enabled and ran _s3:upload\_assets_ **edit: uploads:migrate\_to\_s3** again but…
FileStore::ToS3MigrationError: Some uploads could not be migrated to the new scheme. You need to fix this manually. (FileStore::ToS3MigrationError)
??? You need to fix this manually. (FileStore::ToS3MigrationError)
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [December 11, 2025, 7:05pm UTC](https://meta.discourse.org/t/issues-with-aws-cdn-and-s3/391132/8 "2025-12-11T19:05:24Z")
It sounds like you fixed the bucket and it’s now able to upload assets, so the site should work now. Dealing with the uploads that won’t migrate is another (complicated) issue.
Here’s one of the assets you’re trying to serve:
```plaintext
https://discourse-cdn.repealobbba.org/assets/start-discourse-6f03a463.br.js
```
The cert is broken, so that’s your problem. There is a cert, but it doesn’t match the URL.
As I suggested earlier, look at the network tab of the dev tools in your browser and see this:
---
### Author:  [@philh](https://meta.discourse.org/u/philh)
#### Post date: [December 11, 2025, 7:14pm UTC](https://meta.discourse.org/t/issues-with-aws-cdn-and-s3/391132/9 "2025-12-11T19:14:47Z")
edit from above
Switched to ACLs enabled and ran _s3:upload\_assets_ **edit: uploads:migrate\_to\_s3** again
s3:upload\_assets completes without issues now
I see the network errors. Is the cert an AWS issue?
Thanks again for your time on this!!
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [December 11, 2025, 7:21pm UTC](https://meta.discourse.org/t/issues-with-aws-cdn-and-s3/391132/10 "2025-12-11T19:21:45Z")
> [@philh](#):
>
> I see the network errors. Is the cert an AWS issue?
Yes. The cert doesn’t match the host name. It matches `*.cloudfront.net`
This works: `https://repeal-obbba-discuss-uploads.s3.us-east-1.amazonaws.com/assets/logo-815195ae.png`
This does not work: `https://discourse-cdn.repealobbba.org/assets/start-discourse-6f03a463.br.js`
This works: `https://repeal-obbba-discuss-uploads.s3.us-east-1.amazonaws.com/assets/start-discourse-6f03a463.br.js`
So you need to change your s3 CDN to `https://repeal-obbba-discuss-uploads.s3.us-east-1.amazonaws.com` – oh, I guess that’s the bucket address, so that wouldn’t be ideal, but it would work.
---
### Author:  [@philh](https://meta.discourse.org/u/philh)
#### Post date: [December 11, 2025, 7:52pm UTC](https://meta.discourse.org/t/issues-with-aws-cdn-and-s3/391132/11 "2025-12-11T19:52:20Z")
> [@pfaffman](#):
>
> So you need to change your s3 CDN to `https://repeal-obbba-discuss-uploads.s3.us-east-1.amazonaws.com` – oh, I guess that’s the bucket address, so that wouldn’t be ideal, but it would work.
Not to keen on “so that wouldn’t be ideal” 😉
Looking at AWS Alternate domain names as a possible solution.
Maybe it is just me but adding a CDN that @Discourse uses internally should maybe not be so difficult and require the kind support from folks like @pfaffman
Maybe @Falco or @sam and [@team](https://meta.discourse.org/groups/team) (can’t mention team) can chime in??
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [December 11, 2025, 9:21pm UTC](https://meta.discourse.org/t/issues-with-aws-cdn-and-s3/391132/12 "2025-12-11T21:21:03Z")
> [@philh](#):
>
> @Falco I this still the case?
Yes, all the sites we host use the S3 plus CloudFront combo. Even this site you are browsing right now.
---
### Author:  [@philh](https://meta.discourse.org/u/philh)
#### Post date: [December 11, 2025, 9:39pm UTC](https://meta.discourse.org/t/issues-with-aws-cdn-and-s3/391132/13 "2025-12-11T21:39:09Z")
Thanks for confirming! After seeing this I re-adjusted DISCOURSE\_S3\_CDN\_URL: back to [amazonassigned.cloudfront.net](http://amazonassigned.cloudfront.net) hoping it my clear the cert and url issues.
The rebuilt and re ran all the rakes mentioned in docs.
rake posts:rebake
rake uploads:migrate\_to\_s3 **still generates FileStore::ToS3MigrationError**
rake posts:rebake\_uncooked\_posts
rake s3:upload\_assets
rake s3:expire\_missing\_assets
Still no joy on getting the site to load.
Any suggestions?
---
### Author:  [@philh](https://meta.discourse.org/u/philh)
#### Post date: [December 12, 2025, 8:19am UTC](https://meta.discourse.org/t/issues-with-aws-cdn-and-s3/391132/14 "2025-12-12T08:19:55Z")
> [@philh](#):
>
> Looking at AWS Alternate domain names as a possible solution.
Turns out this was helpful.
---
### Author:  [@philh](https://meta.discourse.org/u/philh)
#### Post date: [December 12, 2025, 5:44pm UTC](https://meta.discourse.org/t/issues-with-aws-cdn-and-s3/391132/15 "2025-12-12T17:44:14Z")
@chapoi kindly split this thread to support
Perhaps @JammyDodger moved to Installation perhaps for better visibility although the forum has been running fine for many months.
Anyway, thanks for the attention!
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [December 12, 2025, 5:46pm UTC](https://meta.discourse.org/t/issues-with-aws-cdn-and-s3/391132/16 "2025-12-12T17:46:14Z")
> [@philh](#):
>
> although the forum has been running fine for many months.
Installation is not only for setting up the forum
> **[Self-hosting](https://meta.discourse.org/c/support/self-hosting/31)**
>
> Getting self-hosted Discourse sites up and running, keeping them going, updating them, and any other general sysadmin maintenance.
---
### Author:  [@philh](https://meta.discourse.org/u/philh)
#### Post date: [December 12, 2025, 5:57pm UTC](https://meta.discourse.org/t/issues-with-aws-cdn-and-s3/391132/17 "2025-12-12T17:57:32Z")
Copy that, thanks for the clarification.
---
### Author:  [@philh](https://meta.discourse.org/u/philh)
#### Post date: [December 12, 2025, 8:20pm UTC](https://meta.discourse.org/t/issues-with-aws-cdn-and-s3/391132/18 "2025-12-12T20:20:52Z")
As mentioned above, add an alternative domain help.
The site loads but without stylesheets and…
> **[Repeal OBBBA Forum](https://forum.repealobbba.org/)**
>
> Repeal the One Big Beautiful Bill Act - Information, discussion, stories, impact AND accountability.
Looking in the bucket I don’t see stylesheets/ folder
Seems s3:upload\_assets is incomplete.
And there is a CORS issue?
---
### Author:  [@philh](https://meta.discourse.org/u/philh)
#### Post date: [December 14, 2025, 9:06am UTC](https://meta.discourse.org/t/issues-with-aws-cdn-and-s3/391132/19 "2025-12-14T09:06:03Z")
Making progress after getting my head around a few things in the docs that were either misleading, confusing or just too much for someone that has BBS.
For us BBS folks putting this in flashing red would help convey “ **you will need two Cloudfront distributions** ”.
> [@Configure an S3 compatible object storage provider for uploads](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/1):
>
> DISCOURSE\_CDN\_URL is a CDN that points to you Discourse hostname and caches requests. It will be used mainly for pullable assets: CSS and other theme assets.
>
> DISCOURSE\_S3\_CDN\_URL is a CDN that points to your object storage bucket and caches requests. It will be mainly used for pushable assets: JS, images and user uploads.
and some instruction on how to
> [@Configure an S3 compatible object storage provider for uploads](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916/1):
>
> We recommend those being different and for admins to set both.
Some updating and consolidating of S3 related topics would be very cool. I think one master topic with current data for AWS S3 CDN and Backups would be awesome.
moving on…
I have two Cloudfront distributions now but:
- The throbber persists [https://discuss.repealobbba.org/](https://discuss.repealobbba.org/)
- Some assets are not visible in the uploads bucket
- some assets are trying to load in the backups bucket
- obvious numerous erorrs in console i.e. The resource at “[https://discourse-cdn.repealobbba.org/stylesheets/common\_theme\_6\_1f8270be80babb5906f2dfb4fa157b7d9f9d12f8.css?\_\_ws=discuss.repealobbba.org”](https://discourse-cdn.repealobbba.org/stylesheets/common_theme_6_1f8270be80babb5906f2dfb4fa157b7d9f9d12f8.css?__ws=discuss.repealobbba.org%E2%80%9D) was blocked by OpaqueResponseBlocking. **Reason: “after sniff: status code is not in allowed range”.**
- I am not certain my implementation of two distributions is correct.
All the rakes execute without error and
and this no longer causes a bootstrap failure.
```plaintext
after_assets_precompile:
- exec:
cd: $home
cmd:
- sudo -E -u discourse bundle exec rake s3:upload_assets
- sudo -E -u discourse bundle exec rake s3:expire_missing_assets
```
CDN checker looks more like a desirable result
All in all progress but some tips from the Discourse infrastructure team would be very helpful.
---
### Author:  [@philh](https://meta.discourse.org/u/philh)
#### Post date: [December 20, 2025, 8:11pm UTC](https://meta.discourse.org/t/issues-with-aws-cdn-and-s3/391132/20 "2025-12-20T20:11:17Z")
Whew! It took a ton of time and some hours (8 over 2 calls) on the phone with a very helpful Amazon engineer but I think I have my head around this. Things are working great on the RepealOBBBA site and my process is reproducible to other sites.
I may write things up but a few notes for now:
1. DISCOURSE\_CDN\_URL (if using AWS S3) and DISCOURSE\_S3\_CDN\_URL require their own Cloudfront distributions.
2. DISCOURSE\_CDN\_URL does not use a bucket.
3. DISCOURSE\_CDN\_URL can be a nonAWS CDN. [Bunny.net](http://Bunny.net) works great. (I am told Bunny Storage with S3 support is due out 2026 1st quarter)
4. DISCOURSE\_CDN\_URL and DISCOURSE\_S3\_CDN\_URL CDNs can be branded urls with the appropriate DNS config.
5. DISCOURSE\_S3\_CDN\_URL requires an uploads bucket.
6. The uploads bucket requires ACLs enabled and “Everyone (public access)” set to “Read” and you must set a policy for the bucket.
7. The backups bucket does not require ACLs or policy.
Edit(s)
1. Check the box in S3 use CDN URL for all uploads: Use CDN URL for all the files uploaded to s3 instead of only for images. Not enabling always caused failures for me.
I imagine many may read the above and go duhhh Phil, no kidding, that is obvious but… my BBS head did not get it right away.
[Next page](https://meta.discourse.org/t/issues-with-aws-cdn-and-s3/391132.md?page=2)