如何通过Rails Active Storage上传至AES256加密AWS S3桶？遇权限拒绝报错

Hey there! Let's tackle this problem step by step—getting Rails Active Storage to upload to an AES-encrypted AWS S3 bucket and fixing that frustrating AccessDenied error.

First, let's make sure your Rails setup is correct:

• Ensure Active Storage is installed: If you're on Rails 5.2+, it's included by default, but if you haven't set it up yet, run:

  rails active_storage:install
  rails db:migrate
  

• Update config/storage.yml: This is where you define your S3 service with encryption settings. Here's a working example:

  amazon:
    service: S3
    access_key_id: <%= Rails.application.credentials.dig(:aws, :access_key_id) %>
    secret_access_key: <%= Rails.application.credentials.dig(:aws, :secret_access_key) %>
    region: us-east-1 # Replace with your bucket's actual region
    bucket: your-encrypted-bucket-name
    server_side_encryption: 'AES256' # *Critical*: Enables S3 server-side AES-256 encryption for uploaded objects
  

• Set the Active Storage service in your environment: For production, add this to config/environments/production.rb:

  config.active_storage.service = :amazon
  

  Do the same for development/test if you're using S3 in those environments too.

Most of the time, this error comes down to IAM permissions or bucket configuration. Let's go through the most common fixes:

2.1 Verify IAM User Permissions #

Your AWS IAM user needs specific permissions to interact with the encrypted bucket. Avoid granting full S3 access—lock it down to what's necessary. Here's a minimal, working policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": "arn:aws:s3:::your-encrypted-bucket-name"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:PutObjectAcl",
        "s3:PutObjectTagging"
      ],
      "Resource": "arn:aws:s3:::your-encrypted-bucket-name/*"
    }
  ]
}

Note: If your bucket uses AWS KMS for AES encryption instead of S3-managed keys, add kms:GenerateDataKey and kms:Decrypt permissions to the policy for your KMS key.

2.2 Check Bucket Default Encryption #

Head to the AWS S3 Console, find your bucket, go to Properties > Default encryption, and confirm that AES-256 (S3 managed keys) is enabled. Even if you set server_side_encryption in Rails, enabling the bucket's default encryption ensures all objects are encrypted automatically and avoids conflicts that could trigger access errors.

2.3 Fix CORS Configuration (For Direct Uploads) #

If you're using Active Storage's direct upload feature (direct_upload: true in your form), your bucket's CORS policy needs to allow PUT requests from your app's domain. Here's a valid CORS rule:

<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
    <AllowedOrigin>https://your-app-domain.com</AllowedOrigin> <!-- Replace with your actual domain -->
    <AllowedMethod>GET</AllowedMethod>
    <AllowedMethod>PUT</AllowedMethod>
    <AllowedMethod>POST</AllowedMethod>
    <AllowedMethod>DELETE</AllowedMethod>
    <AllowedHeader>*</AllowedHeader>
    <ExposeHeader>ETag</ExposeHeader>
</CORSRule>
</CORSConfiguration>

Missing PUT permissions here will cause AccessDenied errors when users upload files directly from the browser.

2.4 Validate Your Credentials #

Double-check that your AWS credentials are correctly stored in Rails credentials (or environment variables). Test this in the Rails console:

client = Aws::S3::Client.new(
  access_key_id: Rails.application.credentials.dig(:aws, :access_key_id),
  secret_access_key: Rails.application.credentials.dig(:aws, :secret_access_key),
  region: 'us-east-1'
)
client.head_bucket(bucket: 'your-encrypted-bucket-name')

If this throws an AccessDenied error, your credentials are either incorrect or the IAM policy isn't applied properly.

2.5 Check Block Public Access Settings #

Make sure your bucket's Block Public Access settings are set correctly. Active Storage uses authenticated IAM requests, so it's safe to keep Block Public Access enabled—just ensure you're not accidentally blocking authenticated requests (the default setting, so this is rarely the issue).

Once you've updated the configuration and permissions, test the upload in the Rails console to confirm:

user = User.first # Replace with your model that uses Active Storage
user.avatar.attach(io: File.open('/path/to/your/test-file.jpg'), filename: 'test.jpg')

If this runs without errors, your setup is working!

内容的提问来源于stack exchange，提问作者Joice Joseph