Django-storages: Setting GS_DEFAULT_ACL to 'publicRead' returns a 400 Bad Request

[ryanovas]

So I'm just trying to get my urls to stop expiring. My bucket on Google is set to public read, and if I remove the query parameters from the url of an expired link then it loads fine. I read the documentation that said to set GS_DEFAULT_ACL = 'publicRead' to return urls without the expiry. So I tried this and now I get 400 errors from the google library whenever I try to upload a file. Here is my code, followed by the error I get:

This is my settings.py

# Django Storages Config to use Google Cloud
from google.oauth2 import service_account

GS_BUCKET_NAME = 'bucket-name'
DEFAULT_FILE_STORAGE = 'storages.backends.gcloud.GoogleCloudStorage'
GS_PROJECT_ID = 'project-id'
GS_DEFAULT_ACL = 'publicRead'
GS_CREDENTIALS = service_account.Credentials.from_service_account_file(
    os.path.join(BASE_DIR, 'assets/auth/google-storage.json')
)

Here is the model in question (though all file uploads fail not just this one):

def path_and_rename_rdoc(instance, filename):
    ext = filename.split('.')[-1]
    filename = '{}.{}'.format(uuid4().hex, ext)
    return os.path.join('document_images', filename)

def validate_file_extension(value):
    ext = os.path.splitext(value.name)[1]
    valid_extensions = ['.jpg','.png','.svg']
    if not ext in valid_extensions:
        raise ValidationError('File not supported!')

class RequiredDocument(models.Model):
    image = models.FileField(upload_to=path_and_rename_rdoc, null=False, validators=[validate_file_extension])

and here's the error:

google.api_core.exceptions.BadRequest: 400 POST https://www.googleapis.com/upload/storage/v1/b/bucket-name/o?uploadType=multipart&predefinedAcl=publicRead: ('Request failed with status code', 400, 'Expected one of', <HTTPStatus.OK: 200>)

I must be doing something dumb and not realizing it, as it works fine if I remove GS_DEFAULT_ACL. It just has expiring links even though the bucket is public. I'm using version 1.7.2, and my service account has Storage Admin permissions.

Thanks for the help!

[podstava]

Same issue pointed out today. Was trying to figure out how to speed up image downloading - setting default_acl='publicRead' works, but now i can`t upload images

[podstava]

@ryanovas The main issue is "Cannot use ACL API to set object policy when object policies are disabled". In bucket permissions set Access control to "Bucket policy & ACLs " and all shoud be working after it.

[ryanovas]

@podstava thanks for responding to this. So I am unable to change the Access Control settings in my bucket, perhaps because it seems if you leave the default option Bucket Policy Only you have 90 days before it becomes permanent. I don't get an error message when I try to change it, it just won't save the other setting. Does this mean that I have to create an entirely new bucket? Is there no way to just... disable the expiration token from being added to the url? Because even "expired" links work fine if I just remove the expiry bits from the URL.

[lewis617]

Sample problem. Is there any update?

[sohaibaslam]

When using this setting, make sure you have fine-grained access control enabled on your bucket, as opposed to Uniform access control, or else, file uploads will return with HTTP 400.

[jschneier]

Thanks @sohaibaslam for the investigation and the docs. Going to close this, please comment if that does not resolve your issue.