Is it possible to use aws_s3 with ACLs disabled?

Viewed 273

I have an S3 Bucket that I am attempting to automate uploads to. When I run the playbook, I am getting the following error:

FAILED! => {"boto3_version": "1.22.0", "botocore_version": "1.25.0", "changed": false,
"error": {"code": "AccessControlListNotSupported", "message": "The bucket does not allow 
ACLs"}, "msg": "Unable to set object ACL: An error occurred 

AWS recommends disabling ACLs, and I am able to use the aws cli just fine with:

aws s3 cp <file name> s3://mybucket/<file name>

My playbook:

- name: Upload logical backup to s3
  aws_s3:
    bucket: "{{ AWS_S3_BACKUP_BUCKET }}"
    aws_access_key: "{{ AWS_S3_BACKUP_ACCESS_KEY_ID }}"
    aws_secret_key: "{{ AWS_S3_BACKUP_SECRET_KEY }}"
    mode: put
    object: logical_db_backups/dump_01.sql.zst
    src: /path/to/my/backup/file

If I enable ACLs, the playbook works. However, I would really prefer to use the one user that is given permissions to access the bucket.

I read the Ansible documentation on the aws_s3 module, and it mentioned nothing about ACLs.

Does anyone know of a way to use this module without ACLs? If not, I'm just going back to regular bash and cron jobs.

Version of ansible: ansible 2.9.6

1 Answers

Root issue:

AWS added the option recently (late Nov 2021) to disable Object ACL's and they confused a lot of people by making it the default/suggested setting even though many client apps are not equipped for this.

Ansible's problem:

The problem is that many clients (Like Ansible, and various SDK's) are not equipped to handle this new feature yet.

I read the Ansible documentation on the aws_s3 module, and it mentioned nothing about ACLs.

ACL's are mentioned in the "permission" section of the documentation, and you're right, it makes no mention of "ACL" (don't ask me why!): https://docs.ansible.com/ansible/2.9/modules/aws_s3_module.html#parameter-permission

Currently, according to Ansible docs, the ACL "permission" param defaults to private and there is no way to tell it to omit the ACL setting.

Workaround:

What I've been doing is keeping buckets in "legacy mode" (aka with ACL's enabled) so that all my client utilities continue to work with the buckets as they always have. See screenshot attached.

enter image description here

Related