Error: "Cannot insert legacy ACL for an object when uniform bucket-level access is enabled."

[jywarren]

We're using this via Paperclip and seeing this error on upload:

Google::Apis::ClientError

invalid: Cannot insert legacy ACL for an object when uniform bucket-level access is enabled. Read more at https://cloud.google.com/storage/docs/uniform-bucket-level-access

https://sentry.io/share/issue/393f9e2786b543be9b2061a933268129/

Our config is:

Paperclip::Attachment.default_options[:storage] = :fog
Paperclip::Attachment.default_options[:fog_directory] = ENV["GOOGLE_STORAGE_BUCKET_NAME"] || ''
Paperclip::Attachment.default_options[:path] = ":rails_root/public/system/system/:class/:attachment/:id_partition/:style/:filename"
Paperclip::Attachment.default_options[:fog_credentials] = {
    provider: ENV["FOG_PROVIDER"] || "Local",
    local_root: "#{Rails.root}/public",
    google_project: 'public-lab' ,
    google_json_key_location: ENV["GOOGLE_JSON_KEY_FILE"] || '' ,
    google_storage_access_key_id: ENV["GOOGLE_STORAGE_KEY"] || '' ,
    google_storage_secret_access_key: ENV["GOOGLE_STORAGE_SECRET"] || ''
}
Paperclip::Attachment.default_options[:fog_public] = true # we tried adding this line or removing it
Paperclip::Attachment.default_options[:fog_host] = ""

Has anyone seen this error? I can't find any mention of uniform bucket level access in this repository.

https://cloud.google.com/storage/docs/uniform-bucket-level-access

Thank you very much!! cc @icarito

[Temikus]

@jywarren so this looks like something on server-side, at least to me, from the docs:

Caution: If you enable uniform bucket-level access, you revoke access from users 
who gain their access solely through object ACLs and prevent users from administrating
permissions using bucket ACLs. Be sure that you read considerations when migrating
an existing bucket prior to enabling uniform bucket-level access.

Can you post the output of:

gsutil uniformbucketlevelaccess get gs://BUCKET_NAME

[icarito]

Hi!
Yes we've been using gcsfuse with this bucket and have found uniform bucket-level access desirable.
The output of the command is:

$ gsutil uniformbucketlevelaccess get gs://production-public-files
Uniform bucket-level access setting for gs://production-public-files:
  Enabled: True
  LockedTime: 2021-05-20 16:23:28.446000+00:00

We can't change the Uniform Bucket Level access unless we clone the bucket, but that's our plan B.
Thanks for your assistance.

[Temikus]

@icarito then in this case the problem is indeed because of the Uniform Bucket Level access. You should still be able to manage ACL's for files in the bucket, but paperclip needs to use the new ACL model, not a legacy one.

In theory the support for fog_public that paperclip uses is there: https://github.com/fog/fog-google/pull/318/files

Can you try deleting the XML credentials from the config (thus forcing the JSON driver) and let me know how it goes?

    google_storage_access_key_id: ENV["GOOGLE_STORAGE_KEY"] || '' ,
    google_storage_secret_access_key: ENV["GOOGLE_STORAGE_SECRET"] || ''

[jywarren]

We tried deleting those creds but still got this, unfortunately:

invalid: Cannot insert legacy ACL for an object when uniform bucket-level access is enabled. Read more at https://cloud.google.com/storage/docs/uniform-bucket-level-access

Is there any way to turn off fog's setting of ACL, and just push the file up respecting whatever the bucket setting is?

[jywarren]

i.e. predefined_acl could be unset or left as default?

[Temikus]

Sorry, busy week.

@icco can you take a look into it? IIRC you know the storage part of things a bit better than me.

[icco]

Hmm, we currently don't have that functionality... but lemme see how hard it would be.

[github-actions]

This issue has been marked inactive and will be closed if no further activity occurs.

[Temikus]

@icco any luck?

[guppy0356]

@Temikus Hello, I have same problems when using CarrierWave. Do you have some good ideas to resolve this.