Search code examples
phpsecurityamazon-s3permissionslaravel-backpack

How can I use temporary URLs with the Laravel Backpack 'image' field and AWS without public access enabled?


I'm trying to use Backpack for Laravel. The image field doesn't seem to support temporary URLs. I would think that if this were a common problem companies have, that it would be native functionality in Backpack. However, our AWS account has public access blocked and I'm not sure if that's standard practice.

It would appear that Backpack assumes anything being accessed by its image field has public access (it has configurations for AWS, after all). The upload field seems to have temporary URL support. So my question is; is my AWS account supposed to have public access enabled? Are image buckets supposed to have public access enabled? What is the industry standard/common practice for AWS permissions?

  1. Tried all sorts of configurations of the Backpack component to get it to use temporary URLs
  2. Tried replicating the HTML, which worked for the column, but not the field
  3. Tried adding a policy to the bucket
  4. Tried making the bucket publicly accessible

Solution

  • The image field depends on Laravel accessors and mutators. For example, if you have an image field for photo, the field itself will not do any uploading or create a temporary URL. Backpack will just call getPhotoAttribute() and setPhotoAttribute() in your model to get or set that attribute. The image field documentation gives you an example of a Mutator, but it's up to you to customize it to fit your needs.

    You should be able to use the image field in Backpack using temporary URLs, if you generate that URL in the accessor. So in your Model you should have:

    Class Product extends Model
    {
        // ..
    
        public function setPhotoAttribute($value)
        {
            // TODO: upload the file to S3
            // see example in https://backpackforlaravel.com/docs/5.x/crud-fields#image-pro
        }
    
        public function getPhotoAttribute($value)
        {
            // TODO: generate a temp URL for it, and return it 
        }
    

    Hope it helps!