Search code examples
ruby-on-railssecurityamazon-s3privacy

Using s3 in a healthcare application, private links

We develop a rails-based healthcare application. What is the best way to configure our s3 implementation so that only the authenticated user has access to the image?

Solution

  • From the Documentation,you should use one of Amazon's "canned" ACLs.

    Amazon accepts the following canned ACLs:

    :private
:public_read
:public_read_write
:authenticated_read
:bucket_owner_read
:bucket_owner_full_control

    You can specify a the ACL at bucket creation or later update a bucket.

    # at create time, defaults to :private when not specified
bucket = s3.buckets.create('name', :acl => :public_read)

# replacing an existing bucket ACL
bucket.acl = :private