How to make Rails uploads to a Digital Ocean bucket to be public by default?

Question

Hi there,

I can upload files from Rails 6 using Active Storage direct upload to a Digital Ocean Spaces bucket, but even when in my app’s storage.yml file I am including a public-read ACL for uploads, when I check the files in the bucket, their permissions are set to private, not public.

Here’s my storage.yml file from the Rails app:

digitalocean:
   service: S3
   access_key_id: <%= Credential.digitalocean_access_key_id %>
   secret_access_key: <%= Credential.digitalocean_secret_access_key %>
   endpoint: https://sfo2.digitaloceanspaces.com
   region: sfo2
   bucket: mybucket
   upload:
     acl: "public-read"

As you can see I do specify a “public-read” upload ACL for Active Storage. The files do upload fine but the file permission is set to private.

Any hints on this, please?

Any help is appreciated, thank you!

Connor Shea · Answer

I think public: true in storage.yml should be sufficient for this in Rails 6.1, looking at the Rails service here: https://github.com/rails/rails/blob/80077d3675b9baceb0fee2a9bef8fcce9cf7080c/activestorage/lib/active_storage/service/s3_service.rb#L23 Keep in mind that if you have existing files you’re trying to access that weren’t set with the proper ACL, this will break those files until you make them have a public ACL. If you need both public and private files depending on what kind it is, you’ll need to use the new feature in 6.1 that allows multiple services to be defined and set per-attribute.

Connor Shea · Answer

Another caveat here: I’ve discovered that since enabling this feature, direct uploads have still been marked as private by default. The problem can be resolved by the comment from astrocket in this issue: https://github.com/rails/rails/issues/39006

Essentially, you need to use a bit of code like this to add the public-read header:

const upload = new DirectUpload(file, "/rails/active_storage/direct_uploads", {
  directUploadWillStoreFileWithXHR: (xhr) => {
    xhr.setRequestHeader('x-amz-acl', 'public-read');
  }
});

You’ll also need to add this x-amz-acl header to the allowed headers in the CORS config for your Spaces instance, otherwise requests will still fail.

Report this

How to make Rails uploads to a Digital Ocean bucket to be public by default?

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today