Storage: Include option to set s3:PutObjectAcl when granting auth/guest access to allow acl: public-read (currently available) in aws-amplify/Storage.put method options.

Is your feature request related to a problem? Please describe. Currently when setting authenticated access to storage, you’re given the option to set put, read, delete access for both auth and unauth access. The aws-amplify package allows passing an acl: public-read (see “other options”). When you try to set this with the default write permissions during setup, you receive a 403 error because the role isn’t set up with PutObjectAcl - you have to manually add the permission to the s3PermissionsAuthenticatedPublic parameter to storage/parameters.json before pushing again.

Pretty common use case to upload photos that are publicly accessible, so this seems like a no-brainer.

Describe the solution you’d like Add a “Grant public access” option when specifying auth permissions during setup.

Describe alternatives you’ve considered Manually adding the permission to the parameters is easy, however, might trip up inexperienced developers who (rightly) expect the aws-amplify/Storage.put option ‘acl: public-read’ to work out of the box.

[benjamindoe]

I’ve discovered my issue was to do with cognito user groups. Users in user groups assume a different IAM role that is not the same as the authRole. You need to add overrides for your user groups as well if you want users that are in those groups to be able to have the same actions. I added this just above where I overwrote s3AuthPublicPolicy

resources.addCfnResource(
  {
    type: "AWS::IAM::Policy",
    properties: {
      PolicyName: "<USER_GROUP_NAME>-group-s3-PutObjectAcl-policy",
      PolicyDocument: {
        Version: "2012-10-17",
        Statement: [
          {
            Action: ["s3:PutObjectAcl"],
            Effect: "Allow",
            Resource: {
              "Fn::Join": [
                "",
                [
                  "arn:aws:s3:::",
                  {
                    Ref: "S3Bucket",
                  },
                  "/*",
                ],
              ],
            },
          },
        ],
      },
      Roles: [
        {
          "Fn::Join": [
            "",
            [
              {
                Ref: "auth<AUTH_RESOURCE_NAME>UserPoolId",
              },
              "-<USER_GROUP_NAME>Role",
            ],
          ],
        },
      ],
    },
  },
  "<USER_GROUP_NAME>PutObjectAclPolicy"
);

Although you can do this with overrides, it should really be an option when you apply privileges using the amplify cli.

[defmtog]

As of amplify 7.6.20 there is no s3-cloudformation-template.json to edit and place the s3:PutObjectACL into anymore. there is only a cli-input.json with enums for permissions:

export enum S3StorageParamsPermissionType {
  CREATE_AND_UPDATE = 'create/update',
  READ = 'read',
  DELETE = 'delete',
}

and there is no enum for PutObjectACL so the manual edit doesn’t work any more. any other suggestions?