Django配置Amazon S3存储桶出现AccessDenied错误且文件未上传问题求助

问题1：文件未上传至S3、仍存储在本地的修复方案 #

• 缺失媒体文件存储配置：当前仅配置了静态文件的存储类，未配置用户上传媒体文件的默认存储类，需在settings.py中新增配置：

  DEFAULT_FILE_STORAGE = 'storages.backends.s3boto3.S3Boto3Storage'
  

• 未执行静态文件同步命令：本地静态文件需要手动执行python manage.py collectstatic才会同步到S3，DEBUG=True的开发模式下Django默认使用本地静态文件服务，不会自动上传资源到S3。
• 缺失存储桶区域配置：当前配置未指定S3桶所属区域，默认会请求us-east-1区域的接口，和你示例桶的us-east-2区域不匹配会导致上传失败，需新增配置：

  AWS_S3_REGION_NAME = 'us-east-2'
  

• IAM用户权限不足：确认对应IAM用户的权限策略至少包含s3:ListBucket、s3:PutObject、s3:GetObject、s3:DeleteObject权限，参考权限策略如下：

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": ["s3:ListBucket"],
              "Resource": ["arn:aws:s3:::remote-hospital-v4"]
          },
          {
              "Effect": "Allow",
              "Action": ["s3:PutObject","s3:GetObject","s3:DeleteObject"],
              "Resource": ["arn:aws:s3:::remote-hospital-v4/*"]
          }
      ]
  }
  

问题2：访问文件返回AccessDenied错误的修复方案 #

• 缺失公共读ACL配置：默认上传的文件是私有权限，仅关闭公共访问阻止无法公开访问，需新增配置：

  AWS_DEFAULT_ACL = 'public-read'
  

• 存储桶未配置公共读桶策略：需给桶添加允许匿名用户读取对象的桶策略，参考配置如下：

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "PublicReadGetObject",
              "Effect": "Allow",
              "Principal": "*",
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::remote-hospital-v4/*"
          }
      ]
  }
  

• 自定义域名配置错误：当前配置的AWS_S3_CUSTOM_DOMAIN没有带上区域后缀，和你实际的桶域名不匹配，需修正配置：

  AWS_S3_CUSTOM_DOMAIN = '%s.s3.us-east-2.amazonaws.com' % AWS_STORAGE_BUCKET_NAME
  

修正后完整配置参考 #

INSTALLED_APPS = [
    #...
    'storages',
]

AWS_ACCESS_KEY_ID = env('AWS_ACCESS_KEY_ID')
AWS_SECRET_ACCESS_KEY = env('AWS_SECRET_ACCESS_KEY')
AWS_STORAGE_BUCKET_NAME = env('AWS_STORAGE_BUCKET_NAME')
AWS_S3_REGION_NAME = 'us-east-2'
AWS_S3_CUSTOM_DOMAIN = '%s.s3.us-east-2.amazonaws.com' % AWS_STORAGE_BUCKET_NAME
AWS_S3_OBJECT_PARAMETERS = {
    'CacheControl': 'max-age=86400',
}
AWS_DEFAULT_ACL = 'public-read'
AWS_LOCATION = 'static'

STATICFILES_DIRS = [
    os.path.join(BASE_DIR / 'static'),
    os.path.join(BASE_DIR / 'build/static')
]
STATIC_URL = 'https://%s/%s/' % (AWS_S3_CUSTOM_DOMAIN, AWS_LOCATION)
MEDIA_URL = 'https://%s/%s/images/' % (AWS_S3_CUSTOM_DOMAIN, AWS_LOCATION)
STATICFILES_STORAGE = 'storages.backends.s3boto3.S3Boto3Storage'
DEFAULT_FILE_STORAGE = 'storages.backends.s3boto3.S3Boto3Storage'

内容的提问来源于stack exchange，提问作者Faisal Nazik