Upload objects to private S3 is not working

[mahcr (Mariano Alvarez)]

After doing a big research, I’ve not found any guide to upload images to S3 with private ACL.

I’m experiencing a weird behavior where the backups work but not uploadimg of images.

I narrowed the issue down to a problem with ACL of the bucket (I proved that the problem is the ACL since I’m able to upload file using the sdk without specifing the ACL flag). In some cases the “block access to public” permission are set at account level and not bucket level so deactivating the checkbox in the bucket config won’t work.

I noticed that the S3 upload config code was updated, and now the ACL is set based on a param, is there away to pass that config down? discourse/lib/file_store/s3_store.rb at tests-passed · discourse/discourse · GitHub

[pfaffman (Jay Pfaffman)]

https://meta.discourse.org/t/secure-media-uploads/meta/140017 describes how to limit uploads to logged in users. Perhaps that will help?

[mahcr (Mariano Alvarez)]

I tried that, images get uploaded but I get a 500 error in the dashboard with no clue, no logs

[shawnngtq (Shawn Ng)]

@mahcr ,

I face the same issue. I can do backup but can’t upload image due to “The bucket does not allow ACLs”.

For IAM, I attached AmazonS3FullAccess policy, but still same error.

Do you have any solution?

[seong (Seong-Young Her)]

I’m having the same issue: backup works but upload doesn’t.

This guide is outdated:

Set up file and image uploads to S3

So, you want to use S3 to handle image uploads? Here’s the definitive guide, but also see Configure an S3 compatible object storage provider for uploads to see how to configure your app.yml. S3 registration Head over to https://aws.amazon.com/free/ and click on [Create a Free Account] During the create account process, make sure you provide payment information, otherwise you won’t be able to use S3. There’s no registration fee, you will only be charged for what you use, if you exceed the AWS …

This guide seems to be valuable for the CDN part, but is not the full solution:

@scottfsmith

For the record here is what I did:

1. Went to AWS console, under Network and Content Delivery picked Cloudfront
2. Clicked the Create distribution button
3. Filled out the fairly obvious form, the only thing you really need to do on it is to pick your AWS S3 bucket where the images are from the drop-down menu.
4. Waited a bit for the Cloudfront configuration to finish…
5. A <gibberish>.cloudfront.net domain showed up in the “Domain Name” column of the Cloudfront Distributions list.
6. I copied and pasted that domain into the s3 cdn url field in my site admin File settings.
7. I did some tests:
   a. I made a new post with an image upload and indeed it was on cloudfront.
   b. I hit Rebuild HTML on some random existing image posts and saw they also rebuilt with cloudfront.net images.
8. Since all looked good I went in and ran a rebake, which took several hours as I have around half a million posts now:

./launcher enter app
# rake posts:rebake

9. All seems to be working fine. It put a ton of jobs in the sidekiq queue, one per post it looks like, which are going to take a few days to clear but it is chunking though them now.

[lisbethw1130 (Lisbeth Wu)]

I got the same issue, too. Backup upload works but image upload shows “The bucket does not allow ACLs”
And it fixed by modifying one permission in IAM and two settings in bucket

First I changed the guide about IAM permission from “s3:HeadBucket” to “s3:ListBucket” because Amazon said HeadBucket is not a valid permission

Then I follow the guide to exactly as same as in permission page in bucket

Then the most important part, enable ACLs, it’s called Edit Object Ownership in permission tab, with ACLs enabled and set to object writer, everything just fine now

Hope my experience can help you