S3: uploads fail with AccessControlListNotSupported on buckets with BucketOwnerEnforced
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- aws, javascript
Research direction
Start in lib/storage/s3.js and inspect the copyIn, enable, and disable entry points, including how bucketObjectsACL and disabledBucketObjectsACL are initialized. Done means false prevents ACL parameters and PutObjectAclCommand calls while the existing default ACL behavior remains unchanged.
Written by the indexing model from the issue text.
Description
Problem
Since April 2023, AWS S3 creates all new buckets with ObjectOwnership: BucketOwnerEnforced
by default, which disables ACLs entirely. uploadfs always sends ACL: 'public-read'
(or whatever bucketObjectsACL is set to) in every copyIn, enable, and disable call,
causing all uploads to fail with:
AccessControlListNotSupported: The bucket does not allow ACLs
Root Cause
In lib/storage/s3.js, the ACL param is always included in requests:
// copyIn
const params = {
Bucket: bucket,
ACL: bucketObjectsACL, // always sent, no way to disable
...
};
// enable / disable also always call PutObjectAclCommand
Expected Behavior
It should be possible to pass bucketObjectsACL: false (and disabledBucketObjectsACL: false)
to skip sending ACL headers entirely, for use with modern S3 buckets or S3-compatible
storage that does not support ACLs.
Suggested Fix
bucketObjectsACL = options.bucketObjectsACL === false
? false
: (options.bucketObjectsACL || 'public-read');
disabledBucketObjectsACL = options.disabledBucketObjectsACL === false
? false
: (options.disabledBucketObjectsACL || 'private');
Then in copyIn, enable, and disable — skip ACL if value is false.
This is fully backward compatible — existing users who don't set these options
get the same public-read default as before.
Related
- Dominant language
- JavaScript
- Stars
- 4.6k
- Forks
- 652
- Avg merge
- 17h 36m
- Merged PRs (30d)
- 29
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from apostrophecms/apostrophe
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
apostrophecms/apostrophe#5594 · 1 comment ·
-
apostrophecms/apostrophe#5590 · 2 comments · 1 assignee ·
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 45/100
apostrophecms/apostrophe#5058 · 4 comments ·
-
bug
Difficulty 4/5 3-5 days Newbie friendliness 38/100
apostrophecms/apostrophe#4892 · 1 comment ·
-
bug
Difficulty 3/5 1-2 days Newbie friendliness 56/100
apostrophecms/apostrophe#4868 · 4 comments ·
All issues in apostrophecms/apostrophe
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
HarperFast/skills#96 ·
-
[Block] Latest Posts [Type] Bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
sugarlabs/musicblocks#8847 ·