# Migrating uploads to s3 does not work with private bucket

**URL:** <https://meta.discourse.org/t/migrating-uploads-to-s3-does-not-work-with-private-bucket/94591>\
**Category:** Feature\
**Created:** [August 13, 2018, 10:41am UTC](https://meta.discourse.org/t/migrating-uploads-to-s3-does-not-work-with-private-bucket/94591 "2018-08-13T10:41:15Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![ash-kadem](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ash-kadem/32/106585_2.png) [@ash-kadem](https://meta.discourse.org/u/ash-kadem)\
**Post date:** [August 13, 2018, 10:41am UTC](https://meta.discourse.org/t/migrating-uploads-to-s3-does-not-work-with-private-bucket/94591/1 "2018-08-13T10:41:15Z")

</div>

Hi all,

We want to use a CDN with Discourse using Cloudfront and S3. The S3 bucket is not public and can only be read by and written to using the Discourse IAM role or Cloudfront. However, if we migrate the existing uploads or try to upload new files we get Access Denied. This is because the bucket does not allow public-read files. I believe that the following piece of code prevents us from using the bucket.

> <https://github.com/discourse/discourse/blob/93dfc87b99eaee9e2bb64abf31ad54f8f1384a0b/lib/file_store/s3_store.rb#L35>

If I remove the piece of code `acl: "public-read"`, then the task `rake uploads:migrate_to_s3` works fine. 🙂

---

_[View the full topic](https://meta.discourse.org/t/migrating-uploads-to-s3-does-not-work-with-private-bucket/94591)._