Add a ACL option to set access permission in S3 bucket catalyst#614

classes/local/manager.php

@@ -71,6 +71,7 @@ public static function get_objectfs_config() {
         $config->s3_key = '';
         $config->s3_secret = '';
         $config->s3_bucket = '';
+        $config->s3_bucket_acl = 'private';
         $config->s3_region = 'us-east-1';
         $config->s3_base_url = '';
         $config->key_prefix = '';

classes/local/store/s3/client.php

@@ -60,6 +60,7 @@ public function __construct($config) {
             // See https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/s3-multipart-upload.html.
             $this->maxupload = OBJECTFS_BYTES_IN_TERABYTE * 5;
             $this->bucket = $config->s3_bucket;
+            $this->bucketacl = $config->s3_bucket_acl;
             $this->expirationtime = $config->expirationtime;
             $this->presignedminfilesize = $config->presignedminfilesize;
             $this->enablepresignedurls = $config->enablepresignedurls;
@@ -328,6 +329,16 @@ protected function get_exception_details($exception) {
      */
     public function define_client_section($settings, $config) {
         global $OUTPUT;
+        $acloptions = [
+            'private' => 'private',
+            'public-read' => 'public-read',
+            'public-read-write' => 'public-read-write',
+            'authenticated-read' => 'authenticated-read',
+            'aws-exec-read' => 'aws-exec-read',
+            'bucket-owner-read' => 'bucket-owner-read',
+            'bucket-owner-full-control' => 'bucket-owner-full-control',
+        ];
+
         $plugins = \core_component::get_plugin_list('local');
 
         if (!array_key_exists('aws', $plugins)) {
@@ -369,6 +380,10 @@ public function define_client_section($settings, $config) {
             new \lang_string('settings:aws:bucket', 'tool_objectfs'),
             new \lang_string('settings:aws:bucket_help', 'tool_objectfs'), ''));
 
+        $settings->add(new \admin_setting_configselect('tool_objectfs/s3_bucket_acl',
+            new \lang_string('settings:aws:bucket_acl', 'tool_objectfs'),
+            new \lang_string('settings:aws:bucket_acl_help', 'tool_objectfs'), 'private', $acloptions));
+
         $settings->add(new admin_settings_aws_region('tool_objectfs/s3_region',
             new \lang_string('settings:aws:region', 'tool_objectfs'),
             new \lang_string('settings:aws:region_help', 'tool_objectfs'), ''));
@@ -401,7 +416,7 @@ public function upload_to_s3($localpath, $contenthash) {
 
         try {
             $externalpath = $this->get_filepath_from_hash($contenthash);
-            $uploader = new \Aws\S3\ObjectUploader($this->client, $this->bucket, $this->bucketkeyprefix . $externalpath, $filehandle);
+            $uploader = new \Aws\S3\ObjectUploader($this->client, $this->bucket, $this->bucketkeyprefix . $externalpath, $filehandle, $this->bucketacl;
             $uploader->upload();
             fclose($filehandle);
         } catch (\Aws\Exception\MultipartUploadException $e) {

lang/en/tool_objectfs.php

@@ -110,6 +110,8 @@
 $string['settings:aws:secret_help'] = 'Amazon S3 secret credential.';
 $string['settings:aws:bucket'] = 'Bucket';
 $string['settings:aws:bucket_help'] = 'Amazon S3 bucket to store files in.';
+$string['settings:aws:bucket_acl'] = 'Bucket ACL';
+$string['settings:aws:bucket_acl_help'] = 'Access permission for files created inside the S3 bucket.';
 $string['settings:aws:region'] = 'region';
 $string['settings:aws:region_help'] = 'Amazon S3 API gateway region.';
 $string['settings:aws:base_url'] = 'Base URL';