Closed subhankar-trisetra closed 11 months ago
nadetastic
commented
11 months ago Hi @subhankar-trisetra thank you for opening this issue. Please note that the parameter for modifying the ACL policy is no longer available with V6. Could you provide some context to what you are looking to achieve with this?
subhankar-trisetra
commented
11 months ago Right, thanks for the response, so the thing is I want the user to be able to upload a file in the level=public folder which aren't shared by other users in the app, however if the user wants a file to be shared as a link, then the putting the acl=public-read helps a lot.
subhankar-trisetra
commented
11 months ago Was there any particular reason for the removal of that parameter? AFAIK, that should be a slight param change in the underlying aws-sdk call right?
nadetastic
commented
11 months ago @subhankar-trisetra i see, thanks for providing context. One of the reasons this has been deprecated is it is not considered best practice to utilize ACLs as described by S3. Im wondering if there's an alternative for you use case - have you considered using the private or protected levels for a file not shared by other users, then moving the file (by copying it) over to the public level that is accessible by other users?
cwomack
commented
11 months ago @subhankar-trisetra, we no longer support the use of the acl input option in v6 due to Amazon S3 service providing more control over ACL's directly. We'll close this issue due to this change being by design, but if there's further issues using the ACL's controls directly in the S3 console then let us know!
AndreasEK
commented
8 months ago @cwomack we have an s3 bucket that hosts images, which are uploaded by different users. Those images are intentionally uploaded as 'protected' (so that users cannot overwrite each others images), but are acl: public-read, so that anybody can anonymously retrieve the image via a cachable url. Please enlighten me, how this can be achieved in amplify v6. 1) Can we set the acl manually after uploading with amplify? I guess we would need to import the standard aws javascript library for that. A "bridge" from amplify to aws would be nice, tbh for use cases that go beyond the standard amplify way of doing things. 2) Can we set some acl or policy on bucket level? As far as I can see, on bucket level, one can only grant a "list" permission. but in order to get the actual object, it need's to be set on object level.
I've spend the better part of the afternoon now trying to figure that out on my own, but (a) the documentation is
So … what do we do? What have you done @subhankar-trisetra ?
subhankar-trisetra
commented
8 months ago I still haven't found a solution to this without changing our whole app architecture in terms of storage. We're still using v5 for now.
AndreasEK
commented
8 months ago That makes me sad
AndreasEK
commented
8 months ago @subhankar-trisetra I've found a workaround for us. Maybe this is interesting for you, too.
I've used an override for the generated amplify resource.
The bucketName section was already present in the override.ts, because some earlier amplify upgrade decided to default to a different naming convention for buckets. The addCfnResource adds a new resource to the cloudformation template. In our case it's a BucketPolicy.
So - even if this might not solve your requirements, maybe this sparks an idea.
import { AmplifyS3ResourceTemplate } from '@aws-amplify/cli-extensibility-helper';
// AmplifyS3ResourceTemplate | see https://github.com/aws-amplify/amplify-cli/issues/9063#issuecomment-1034426494
export function override(resources: any) {
resources.s3Bucket.bucketName = {
'Fn::If': [
'ShouldNotCreateEnvResources',
{
Ref: 'bucketName',
},
{
'Fn::Join': [
'',
[
{
Ref: 'bucketName',
},
'-',
{
Ref: 'env',
},
],
],
},
],
};
resources.addCfnResource(
{
type: 'AWS::S3::BucketPolicy',
properties: {
Bucket: resources.s3Bucket.bucketName,
PolicyDocument: {
Version: '2012-10-17',
Id: 'Policy1708334814278',
Statement: [
{
Sid: 'Stmt1708334806707',
Effect: 'Allow',
Principal: '*',
Action: 's3:GetObject',
Resource: {
'Fn::Join': [
'',
['arn:aws:s3:::', resources.s3Bucket.bucketName, '/*'],
],
},
},
],
},
},
},
'PublicReadBucketPolicy',
);
}
Before opening, please confirm:
JavaScript Framework
React
Amplify APIs
Storage
Amplify Categories
storage
Environment information
Describe the bug
Previously I could set the acl using the v5 api, however I'm not able to do that in v6. Any solution to that? Or how is it working internally?
Expected behavior
I'm thinking
aclshould be present in the currentuploadDatafunction.Reproduction steps
NA
Code Snippet
Log output
aws-exports.js
No response
Manual configuration
No response
Additional configuration
No response
Mobile Device
No response
Mobile Operating System
No response
Mobile Browser
No response
Mobile Browser Version
No response
Additional information and screenshots
No response