Android端设置CannedAccessControlList.PublicRead上传S3文件失败

Hey there! Let’s figure out why your S3 uploads started failing right after you added the CannedAccessControlList.PublicRead setting—this is a common gotcha, so let’s break down the most likely causes and fixes.

1. IAM权限缺失（最常见原因） #

When you add a public ACL to an object, your upload process needs more than just the basic s3:PutObject permission. It also requires the s3:PutObjectAcl permission to modify the object’s access control settings. If your IAM user/role doesn’t have this permission, AWS will reject the upload with an AccessDenied error (even if your callback just says "FAILED").

To fix this, update your IAM policy to include both permissions. Here’s a sample policy snippet:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*"
        }
    ]
}

Make sure to replace YOUR_BUCKET_NAME with your actual bucket name, and use the IAM Policy Simulator to verify the permissions work as expected.

2. 存储桶的Block Public Access设置拦截了请求 #

AWS has a security feature called Block Public Access that can override your object-level ACL settings. If your bucket has the "Block public access to buckets and objects granted through any access control lists (ACLs)" option enabled, setting PublicRead will be blocked automatically.

Check this setting by:

• Going to your S3 bucket in the AWS Console
• Navigating to the Permissions tab
• Looking at the Block Public Access section
• Ensuring none of the options that block ACL-based public access are enabled (adjust if needed, but be mindful of security implications)

3. Bucket Policy冲突 #

If your bucket has a Bucket Policy that explicitly denies public access or restricts s3:PutObjectAcl operations, this will clash with your PublicRead setting. For example, a policy that includes a Deny statement for actions related to public ACLs will stop your uploads.

Review your Bucket Policy for any rules that might block:

• s3:PutObjectAcl actions
• Access by * (public users)
• Conditions that prevent public object access

4. 排查具体错误信息（关键第一步） #

First things first—don’t rely solely on the "FAILED" callback status. Dig into the actual error response from the AWS SDK. Most SDKs will return a detailed error code (like AccessDenied, InvalidBucketPolicy, etc.) and message that will point you directly to the issue.

For example, in your code, you can add error handling to log the full error details:

// Example error handling for AWS SDK for Java
uploadObserver.setProgressListener(new ProgressListener() {
    @Override
    public void progressChanged(ProgressEvent progressEvent) {
        if (progressEvent.getEventType() == ProgressEventType.TRANSFER_FAILED_EVENT) {
            Exception exception = uploadObserver.getException();
            if (exception != null) {
                exception.printStackTrace(); // Log the full error details
            }
        }
    }
});

最后提醒 #

Once you fix the upload issue, double-check that making objects publicly accessible is intentional for your use case. Public S3 objects can be accessed by anyone on the internet, so ensure you’re not exposing sensitive data.

内容的提问来源于stack exchange，提问作者karthik kolanji