Merge pull request #457 from iterate-ch/issue/436

Improve S3 documentation for share links
iterate-ch · Dec 3, 2023 · f41d0e3 · f41d0e3
2 parents 973bcce + 1acfe73
commit f41d0e3
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 2 deletions.
diff --git a/cyberduck/share.md b/cyberduck/share.md
@@ -33,7 +33,7 @@ Providers with support to share a file using a public, password protected or tem
 
 ### S3
 
-For connections using [S3](../protocols/s3/index.md) protocol.
+For connections using [S3](../protocols/s3/index.md) protocol, make sure the bucket allows [ACLs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html?icmpid=docs_amazons3_console) and doesn't block [public access](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html?icmpid=docs_amazons3_console).
 
 `````{tabs}
 ````{group-tab} Cyberduck

diff --git a/protocols/s3/index.md b/protocols/s3/index.md
@@ -544,7 +544,7 @@ You can access all URLs (including from [CDN](../../protocols/cdn/cloudfront.md)
 ```{important}
 Public URLs are only accessible if the permission `READ` is granted for `EVERYONE`.
 ```
-
+ 
 Choose *File → Share…* to change the ACL on the file permanently allowing read for everyone. You can reset the changed ACL in [Info → ACL](../../cyberduck/info.md#access-control-list-acl).
 
 ### Pre-signed Temporary URLs
@@ -565,6 +565,14 @@ Using the AWS4 signature version used in Cyberduck version 5.0 and later, pre-si
 This deprecated signature version is not compatible with new regions such as `eu-central-1`.
 ```
 
+### Limitations
+
+Share links cannot be created when failing to update the ACLs on a file because
+
+* Bucket has "Object Ownership" set to "Bucket owner enforced" ([ACLs disabled](https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html?icmpid=docs_amazons3_console)). 
+Error message: `This bucket does not allow ACLs`
+* ["Block public acccess"](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html?icmpid=docs_amazons3_console) is enabled on bucket. Error message: `Access denied` 
+
 ## Metadata
 
 You can edit standard HTTP headers and add [custom HTTP headers](../../cyberduck/info.md#metadata-http-headers) to files to store [metadata](http://docs.amazonwebservices.com/AmazonS3/latest/index.html?UsingMetadata.html). Choose *File → Info (macOS `⌘I` Windows `Alt+Return`) → Metadata* to edit headers.