Amazon Bucket settings for fof/upload

Sallymelek

So I had this question asked on Flarum, one gave an answer. What are the recommended settings for using s3 for uploads?
“Also I received this email from Amazon - Notification of Amazon S3 buckets configured for public access”

Hello,

We are writing to notify you that you have configured your S3 bucket(s) to be publicly accessible, and this may be a larger audience than you intended. By default, S3 buckets allow only the account owner to access the contents of a bucket; however, customers can configure S3 buckets to permit public access. Public buckets are accessible by anyone on the Internet, and content in them may be indexed by search engines.

We recommend enabling the S3 Block Public Access feature on buckets if public access is not required. S3 bucket permissions should never allow “Principal”:“*” unless you intend to grant public access to your data. Additionally, S3 bucket ACLs should be appropriately scoped to prevent unintended access to “Authenticated Users” (anyone with an AWS account) or “Everyone” (anyone with Internet access) unless your use case requires it. For AWS’s definition of “Public Access,” please see The Meaning of "Public” [1].

The list of buckets which can be publicly accessed is below:

acehscforumcloud | ap-southeast-2

You can ensure individual buckets, or all your buckets prevent public access by turning on the S3 Block Public Access feature [2]. This feature is free of charge and it only takes a minute to enable. For step by step instructions on setting up S3 Block Public Access via the S3 management console, see Jeff Barr’s blog [3], or check out the video tutorial on Block Public Access [4].

If you have a business need to maintain some level of public access, please see Overview of Managing Access [5] for more in-depth instructions on managing access to your bucket to make sure you’ve permitted the correct level of access to your objects. If you would like more information about policy configuration in S3, please refer to Managing Access in Amazon S3 [6], and S3 Security Best Practices [7].

We recommend that you make changes in accordance with your operational best practices.

If you believe you have received this message in error or if you require technical assistance, please open a support case [8].

[1] https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html#access-control-block-public-access-policy-status
[2] https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html
[3] https://aws.amazon.com/blogs/aws/amazon-s3-block-public-access-another-layer-of-protection-for-your-accounts-and-buckets/
[4] https://aws.amazon.com/s3/features/block-public-access/
[5] https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-overview.html#access-control-resources-manage-permissions-basics
[6] https://docs.aws.amazon.com/AmazonS3/latest/dev/s3-access-control.html
[7] https://docs.aws.amazon.com/AmazonS3/latest/dev/security-best-practices.html
[8] https://aws.amazon.com/support

Sincerely,
Amazon Web Services

phenomlab

Sallymelek Let’s first start with securing the S3 bucket. Currently, it’s publicly accessible, which is not what you want. I’m surer you’ve ready about companies that get hacked because their security of S3 is lax to stay the least, and in virtually every case, it’s because the bucket is publicly available.

Sallymelek

so do I need turn everything on then?

phenomlab

Sallymelek Yes. 100%

Sallymelek

phenomlab so I switched everything to ON, however, now the images that were uploaded on s3 from the forum now are arent accessible.

phenomlab

Sallymelek Can you provide a screenshot of the fof/upload settings in relation to AWS S3 ?

Sallymelek

https://forum.acehsc.net/p/5
check out this page, none of the gifs is showing

phenomlab

Sallymelek Yes, I see it.

If you look at the returned XML, you’ll see the below

<Code>AccessDenied</Code>
<Message>Access Denied</Message>
<RequestId>C4A2DA90CC1CB14B</RequestId>
<HostId>_REDACTED_</HostId>
</Error>

You’ll need to configure an ACL for the S3 image retrieval to work. You should be able to complete this in the AWS portal, and the connecting host would be the IP address of your server

Sallymelek

which one do i need to configure?

phenomlab

Sallymelek The “everyone”, but you’re only going to permit your own IP address.

Sallymelek

or is it this?

Sallymelek

phenomlab

Im confused, for “everyone” part is it for Objects or Bucket ACL?

phenomlab

Sallymelek Bucket ACL.

Sallymelek

phenomlab getting this issue

phenomlab

Sallymelek Did someone else setup the AWS account, or do you have access to the root account ? By the looks of it, the account you are using doesn’t have the required permissions.

Sallymelek

I created the account

phenomlab

Sallymelek Can you login as root ?

Sallymelek

I logged off, signed back in as root. The same thing is happening.

phenomlab

Sallymelek I’d raise a support request with AWS in that case.

Sallymelek

phenomlab Raised a ticket with AWS, but no help. So I have decided to create a new bucket. Should I disable/enable “default encryption”?