How to Set Amazon S3 File Permissions using SyncS3

By default, SyncS3 for Gravity Forms uploads files to Amazon S3 with private file permissions. This means the only way to access them is with a signed URL – SyncS3 signs the URLs in the admin so you can easily view them. If you want to offer public access to the files, such as viewing images or downloading zip files, you’ll need to adjust the files’ permission settings.

The Bucket Policy

To change a file’s permission settings, you first need to ensure that access to the file isn’t denied at the bucket level via the bucket policy. The easiest solution may be to not have any bucket policy. This will let you set access permissions on a per-file basis. However, if you have a reason for a bucket policy, you’ll need to adjust it to exclude the files you want to keep public.

Here’s an example bucket policy that denies access to bucket files, unless requested from an authorized website.

{
    "Version": "2012-10-17",
    "Id": "http referer policy example",
    "Statement": [
        {
            "Sid": "Allow get requests referred by mywebsite.com.",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/*",
            "Condition": {
                "StringLike": {
                    "aws:Referer": "https://mywebsite.com/*"
                }
            }
        },
        {
            "Sid": "Explicit deny to ensure requests are allowed only from specific referer.",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/*",
            "Condition": {
                "StringNotLike": {
                    "aws:Referer": "https://mywebsite.com/*"
                }
            }
        }
    ]
}

This policy denies access to any file in the my-bucket bucket, unless the request is from https://mywebsite.com. You’ll need to modify the policy to set your bucket name and website URL. You can also modify the Resource path if your public files are saved to a subfolder.

SyncS3 Filter

It is currently on our development roadmap to build a feature into SyncS3 that lets you select a canned ACL option for your file uploads. Until then, you can use the syncs3_put_object_acl filter to override the file’s ACL permission.

add_filter( 'syncs3_put_object_acl', 'em_syncs3_object_acl', 10, 6 );
/**
 * Filters the Access Control List for an object.
 * For possible choices, see https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl.
 *
 * @param  string 	$acl       	ACL (default: 'private')
 * @param  string 	$file      	Local file URL when uploaded
 * @param  string 	$file_name 	Name of uploaded file
 * @param  int 		$field_id  	ID of the fileupload field
 * @param  int 		$form_id   	ID of the form
 * @param  array 	$entry     	Entry data
 *
 * @return string
 */
function em_syncs3_object_acl( $acl, $file, $file_name, $field_id, $form_id, $entry ) {
	// Logic here if needed
	return 'public-read';
}

This snippet sets all files uploaded by SyncS3 to public-read. You’ll need to add your own logic if needed. The filter make available data about the entry, form, and field so you can run your own logic.

After you’ve set your bucket policy and filtered the file’s ACL permission, files will be accessible according to your custom permissions. If you’ve set your bucket policy and ACL to allow for public-read access, you can link to the files with the stored S3 URLs, and user won’t get the “Access Denied” XML error they’d normally receive when the file is set to private.