Question

How to make Rails uploads to a Digital Ocean bucket to be public by default?

Hi there,

I can upload files from Rails 6 using Active Storage direct upload to a Digital Ocean Spaces bucket, but even when in my app’s storage.yml file I am including a public-read ACL for uploads, when I check the files in the bucket, their permissions are set to private, not public.

Here’s my storage.yml file from the Rails app:

digitalocean:
   service: S3
   access_key_id: <%= Credential.digitalocean_access_key_id %>
   secret_access_key: <%= Credential.digitalocean_secret_access_key %>
   endpoint: https://sfo2.digitaloceanspaces.com
   region: sfo2
   bucket: mybucket
   upload:
     acl: "public-read"

As you can see I do specify a “public-read” upload ACL for Active Storage. The files do upload fine but the file permission is set to private.

Any hints on this, please?

Any help is appreciated, thank you!

Show comments
Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Connor Shea • December 27, 2020

Another caveat here: I’ve discovered that since enabling this feature, direct uploads have still been marked as private by default. The problem can be resolved by the comment from astrocket in this issue: https://github.com/rails/rails/issues/39006

Essentially, you need to use a bit of code like this to add the public-read header:

const upload = new DirectUpload(file, "/rails/active_storage/direct_uploads", {
  directUploadWillStoreFileWithXHR: (xhr) => {
    xhr.setRequestHeader('x-amz-acl', 'public-read');
  }
});

You’ll also need to add this x-amz-acl header to the allowed headers in the CORS config for your Spaces instance, otherwise requests will still fail.

Connor Shea • December 17, 2020

I think public: true in storage.yml should be sufficient for this in Rails 6.1, looking at the Rails service here: https://github.com/rails/rails/blob/80077d3675b9baceb0fee2a9bef8fcce9cf7080c/activestorage/lib/active_storage/service/s3_service.rb#L23

Keep in mind that if you have existing files you’re trying to access that weren’t set with the proper ACL, this will break those files until you make them have a public ACL. If you need both public and private files depending on what kind it is, you’ll need to use the new feature in 6.1 that allows multiple services to be defined and set per-attribute.