luneski/mqtt-explorer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove --acl from S3 upload for BucketOwnerEnforced buckets (#979)

Browse Source 
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: thomasnordquist <7721625+thomasnordquist@users.noreply.github.com>
This commit is contained in:
Copilot
2025-12-23 14:48:29 +01:00
committed by GitHub
parent 0d34f86893
commit 9e1c229a5d
2 changed files with 19 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
.github/workflows/tests.yml vendored
View File

@@ -96,8 +96,7 @@ jobs:
--bucket ${AWS_BUCKET} \ --bucket ${AWS_BUCKET} \
--key ${FILENAME} \ --key ${FILENAME} \
--body ./ui-test.gif \ --body ./ui-test.gif \
--tagging "expiration=90days&Source=github-actions&Type=pr-demo-video" \ --tagging "expiration=90days&Source=github-actions&Type=pr-demo-video"
--acl public-read
- name: Generate file URL - name: Generate file URL
id: fileurl id: fileurl
env: env:

20
CI_CD.md
View File

@@ -268,16 +268,32 @@ aws s3api get-bucket-lifecycle-configuration --bucket YOUR_BUCKET_NAME
#### Required AWS Credentials #### Required AWS Credentials
The workflow requires the following secrets/variables: The workflow requires the following secrets/variables:
- `vars.AWS_KEY_ID` - AWS access key ID (requires `s3:PutObject`, `s3:PutObjectTagging`, and `s3:PutObjectAcl` permissions) - `vars.AWS_KEY_ID` - AWS access key ID (requires `s3:PutObject` and `s3:PutObjectTagging` permissions)
- `secrets.AWS_SECRET_ACCESS_KEY` - AWS secret access key - `secrets.AWS_SECRET_ACCESS_KEY` - AWS secret access key
- `vars.AWS_BUCKET` - S3 bucket name - `vars.AWS_BUCKET` - S3 bucket name
- AWS region: `eu-central-1` (hardcoded in workflow) - AWS region: `eu-central-1` (hardcoded in workflow)
The S3 bucket must have: The S3 bucket must have:
- Public read access enabled for uploaded objects (via ACL or bucket policy) - **Bucket policy for public read access**: Since ACLs are disabled (BucketOwnerEnforced), a bucket policy must grant public read access to uploaded objects
- Object tagging enabled - Object tagging enabled
- Lifecycle policy configured as described above - Lifecycle policy configured as described above
**Example S3 Bucket Policy for Public Read Access**:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "PublicReadGetObject",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*"
}
]
}
```
The workflow uses AWS CLI v2 installed directly and `aws-actions/configure-aws-credentials@v4` action for secure credential management. The workflow uses AWS CLI v2 installed directly and `aws-actions/configure-aws-credentials@v4` action for secure credential management.
## Troubleshooting ## Troubleshooting