# S3 image upload access denied while backups upload working fine
**URL:** https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071
**Category:** Self-hosting
**Tags:** s3
**Created:** [12.Декабрь.2018 03:02:28 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071 "2018-12-12T03:02:28Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@Umashankar\_Ankuri](https://meta.discourse.org/u/Umashankar_Ankuri)
#### Post date: [12.Декабрь.2018 03:02:28 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/1 "2018-12-12T03:02:28Z")
I’m getting an issue with S3 setup, wherein backups are uploading just fine to the s3 bucket but image uploads give this error
Encountered an error while migrating /uploads/default/original/1X/ea17a258eff7a95045bda914c10bac5a2de02c62.png: Aws::S3::Errors::AccessDenied: Access Denied while running rake task `uploads:migrate_to_s3`
Please help.
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [12.Декабрь.2018 06:05:19 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/2 "2018-12-12T06:05:19Z")
U sure Your S3 credentials have necessary permissions to interact with the bucket?
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [12.Декабрь.2018 06:11:10 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/3 "2018-12-12T06:11:10Z")
It’s inadvisable to use the same bucket for backups and images, there are known issues with the admin dashboard when you do this. I would strongly recommend setting up a separate bucket for your images.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [12.Декабрь.2018 06:11:30 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/4 "2018-12-12T06:11:30Z")
> [@Stephen](#):
>
> It’s inadvisable to use the same bucket for backups and images
I thought we added protection for this @gerhard? It comes up wayyy too much.
---
### Author:  [@Umashankar\_Ankuri](https://meta.discourse.org/u/Umashankar_Ankuri)
#### Post date: [12.Декабрь.2018 16:54:00 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/5 "2018-12-12T16:54:00Z")
Hi,
Thanks for the reply.
I have created IAM policy like this, and I could see right read right permissions on s3 bucket permissions tab.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::bucket",
"arn:aws:s3:::bucket/*"
]
}
]
}
```
Let me know if any thing I’m missing. Strange thing is that how come backups are able to upload to the same bucket while images aren’t
Thank you
---
### Author:  [@Umashankar\_Ankuri](https://meta.discourse.org/u/Umashankar_Ankuri)
#### Post date: [12.Декабрь.2018 16:55:26 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/6 "2018-12-12T16:55:26Z")
Hi Stephen,
Thanks for the reply. will try this
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [12.Декабрь.2018 17:25:04 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/7 "2018-12-12T17:25:04Z")
You need separate bucket for assets and backup.
---
### Author:  [@Umashankar\_Ankuri](https://meta.discourse.org/u/Umashankar_Ankuri)
#### Post date: [12.Декабрь.2018 18:07:43 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/8 "2018-12-12T18:07:43Z")
Hi @itsbhanusharma
created separate bucket but still the same issue, but when the same bucket is used with backups they are uploading ..
Any pointers?
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [12.Декабрь.2018 18:12:21 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/9 "2018-12-12T18:12:21Z")
Do You see any errors in the Logs?
---
### Author:  [@Umashankar\_Ankuri](https://meta.discourse.org/u/Umashankar_Ankuri)
#### Post date: [12.Декабрь.2018 18:13:39 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/10 "2018-12-12T18:13:39Z")
I’m running rake task for existing uploads
I get this error /uploads/default/original/1X/eb7e7463785d0041c85688b1329c5568c75f7a12.png: Aws::S3::Errors::AccessDenied: Access Denied
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [12.Декабрь.2018 18:16:46 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/11 "2018-12-12T18:16:46Z")
The best that I can tell from this error is that it is a permissions issue!
I’d start diagnosing from AWS then follow it up with a thorough investigation in admin dashboard for ommission or mispelled bucket names. If none of that works, I’d also recommend upgrading to latest and doing a rebuild just in case it’s just some old code not playing nice.
---
### Author:  [@Umashankar\_Ankuri](https://meta.discourse.org/u/Umashankar_Ankuri)
#### Post date: [12.Декабрь.2018 18:23:24 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/12 "2018-12-12T18:23:24Z")
Thanks for quick reply.
yes. it is already clear from the log that it is at AWS, bucket is given with caution following std., so couldn’t be that and discourse is latest. something is not catching my eyes at AWS ☹
will check again
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [13.Декабрь.2018 23:09:17 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/13 "2018-12-13T23:09:17Z")
In this case it seems to be a different problem.
Anyway, I’m working on preventing the dashboard from timing out by converting the storage stats into a proper report and I’ll add protection against bucket reusage too.
---
### Author:  [@RBoy](https://meta.discourse.org/u/RBoy)
#### Post date: [03.Январь.2019 03:05:47 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/14 "2019-01-03T03:05:47Z")
I see in the latest release notes that 2.2.0 BETA 7 has a new feature for backups which requires separate buckets for discourse.
Is there a topic or post that elaborates on this and what needs to be done for existing setups to ensure nothing breaks. Preferably a step by step guide on how to make changes to S3, what permissions, what to check, what to change on discourse etc.
This was more like a setup and forget it step so I don’t even recall what I had done to get it working, it’s just been working and I’m concerned that upgrading to BETA 7 will now break something.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [03.Январь.2019 03:32:17 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/15 "2019-01-03T03:32:17Z")
I believe @gerhard can elaborate.
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [03.Январь.2019 22:26:10 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/16 "2019-01-03T22:26:10Z")
> [@RBoy](#):
>
> Is there a topic or post that elaborates on this
I’m currently updating our various S3 related Howto topics so that they reflect the latest changes in Discourse and S3. I’ll notify you when that’s done.
Essentially you need to either use two different buckets or a prefix for the backup bucket. For example, the following combinations will work:
1. Different buckets
- `s3_upload_bucket`: `my-upload-bucket`
- `s3_backup_bucket`: `my-backup-bucket`
2. Different prefixes
- `s3_upload_bucket`: `my-bucket/uploads`
- `s3_backup_bucket`: `my-bucket/backups`
3. Prefix for backups
- `s3_upload_bucket`: `my-bucket`
- `s3_backup_bucket`: `my-bucket/backups`
---
### Author:  [@RBoy](https://meta.discourse.org/u/RBoy)
#### Post date: [03.Январь.2019 22:51:09 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/17 "2019-01-03T22:51:09Z")
Appreciate it, it would nice if you can highlight any special instructions/steps for existing installation to migrate to this new structure. The obvious concern is to avoid breaking something / lose data while going through this process. Can you recommend if one should make the changes first and then upgrade or vice-versa?
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [04.Январь.2019 13:33:59 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/18 "2019-01-04T13:33:59Z")
I assume both `s3_upload_bucket` and `s3_backup_bucket` currently have the same value (`name-of-your-bucket`) without any prefix.
The easiest solution in your case would be option 3 from above. Update the `s3_backup_bucket` and append a folder name to the bucket (e.g. `name-of-your-bucket/backups`). You can use the [S3 Console](https://s3.console.aws.amazon.com/s3) to [move existing backups](https://docs.aws.amazon.com/AmazonS3/latest/gsg/CopyingAnObject.html) into the new folder.
> [@RBoy](#):
>
> Can you recommend if one should make the changes first and then upgrade or vice-versa?
I guess changing the bucket settings before the upgrade is a good idea, but I afterwards should be fine too.
---
### Author:  [@RBoy](https://meta.discourse.org/u/RBoy)
#### Post date: [04.Январь.2019 16:59:27 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/19 "2019-01-04T16:59:27Z")
Option 3 - That was easy to move the backups to a folder within the bucket. Here are the steps I followed:
- I created a folder in the bucket
- moved the backup files into it and then
- changed the `s3 backup bucket` setting on discourse
- did a manual backup to test that it’s working
Thanks!
A related question about the “uploads” since this is “live” v/s the backup which is accessed once a day.
1. I see just 2 folders Original and Optimized, nothing else - I’m guessing that how it supposed to be
2. Using option 2, moving these 2 folders to a new folder called `upload` in the bucket, what’s the risk of breaking something here by doing it on the fly? What’s the right way to do it. E.g. move the folders into `upload` and then modify Discourse `s3 upload bucket` setting or vice versa or some other way?
EDIT: Or put the site into read-only mode, then move the folders in the buckets and finally update the settings on discourse upload bucket name?
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [04.Январь.2019 18:15:11 UTC](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071/20 "2019-01-04T18:15:11Z")
> [@RBoy](#):
>
> I see just 2 folders Original and Optimized, nothing else
But those folders aren’t empty, are they?
Switching to option 2 is definitely the hardest. You’d need to rebake all posts after moving the files and updating the site setting. Of course it’s up to you, but I wouldn’t change a thing. Option 3 is supported and works.
[Следующая страница](https://meta.discourse.org/t/s3-image-upload-access-denied-while-backups-upload-working-fine/104071.md?page=2)