主动存储通过加密上传到 S3。 如何删除加密并将文件按原样保存在存储中

Question

When I upload a file with API multipart to rails server. Rails server uploads the file to s3. But when I go to s3, the file is encrypted which I don't want.

Also when I get the URL from in jbuilder

json.url Rails.application.routes.url_helpers.rails_blob_url(document.doc) 

the URL I get is of rails path which redirects to S3 image with a key to show the image.

It will be better if I can put the S3 link directly there in the file URL.

Answer 1

The Active Storage doesn't store a file with the provided filename instead it uses Rails' has_secure_token key. So even if you try to see the file stored on local (if you're using a deffault local service), it'll be saved with some random alpha-numeric string.

If you want to explicitly upload with AWS Server Side Encryption you might want to update the service config like -

amazon:
  service: S3
  bucket: somebucketname
  upload:
    server_side_encryption: AES-256

One possibility you can find if it works by implementing a custom ActiveStorage::Service . If somebody does it, please share: :D

Or else just go with the Carrierwave !!

Ref -

1. ActiveStorage::Blob
2. ActiveStorage::Service

Answer 2

If you are using Rails active storage and don't want to encrypt files by default you need to change storage.yml to something like this.

amazon:
  service: S3
  bucket: somebucketname
  upload:
    server_side_encryption: nil

Or if you are using aws-sdk-s3 gem, here is the link for official guide for aws-sdk-s3

Also you can change existing files encryption from AWS. Here is the documentation.

For URL part you can call object.images[0].service_url This will return you something like https://yourbucketname.s3.eu-central-1.amazonaws.com/yr2r6bo1ai1g9yavg7p9480ptdy4?response-content-disposition=inline%3B%20filename%3D%22images-museum_5_3.png%22%3B%20filename%2A%3DUTF-8%27%27images-museum_5_3.png&response-content-type=image%2Fjpeg&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAJJWMS7WXXZREOOCQ%2F20200413%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20200413T123825Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=14bf4d26d9b3f3c98c29d84c647fc6fa88d903e157a0d41e0ad209937ffaf92b

You can store first part as object URL. It not changing part of URL.

That part is https://yourbucketname.s3.eu-central-1.amazonaws.com/yr2r6bo1ai1g9yavg7p9480ptdy4