Question

How use ACL with PutObject and Pre-signed URL

Posted on April 5, 2024
DigitalOcean Spaces API
Asked by jonathan

I’m encountering a SignatureDoesNotMatch error when attempting to set the ACL to “public-read” within a PutObject command using a pre-signed URL. The request utilizes the PUT verb against the pre-signed URL.

Is there a limitation on including the ACL parameter with a pre-signed URL?

PS: I am using AWS SDK PHP to create the pre-signed URL.

Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Abraham12611 • April 6, 2024

There is indeed a limitation with using the ACL parameter and pre-signed URLs in the AWS SDK for PHP. Pre-signed URLs are designed to grant temporary access with predefined permissions, and including ACL attempts to modify the object’s access control beyond the pre-signed URL’s scope.

Here’s how you can address it:

Separate the actions: Create a separate pre-signed URL for the PutObject action without the ACL parameter. Then, use a different API call (e.g., putObjectAcl) to set the ACL to “public-read” after uploading the object.
Consider IAM Policies: If you require public access to the object, consider setting the bucket policy or a specific object policy on the S3 console to “public-read” instead of relying on the ACL parameter during upload. This avoids pre-signed URL limitations.