Merge pull request #1796 from lopuhin/s3-acl-private

[MRG+1] Change default S3 ACL to "private" and allow customization via settings

docs/topics/settings.rst

@@ -607,6 +607,15 @@ For more information See the :ref:`extensions user guide  <topics-extensions>`
 and the :ref:`list of available extensions <topics-extensions-ref>`.
 
 
+.. setting:: FILES_STORE_S3_ACL
+
+FILES_STORE_S3_ACL
+------------------
+
+Default: ``'private'``
+
+S3-specific access control policy (ACL) for S3 files store.
+
 .. setting:: ITEM_PIPELINES
 
 ITEM_PIPELINES

scrapy/pipelines/files.py

@@ -82,7 +82,8 @@ class S3FilesStore(object):
     AWS_ACCESS_KEY_ID = None
     AWS_SECRET_ACCESS_KEY = None
 
-    POLICY = 'public-read'
+    POLICY = 'private'  # Overriden from settings.FILES_STORE_S3_ACL in
+                        # FilesPipeline.from_settings.
     HEADERS = {
         'Cache-Control': 'max-age=172800',
     }
@@ -232,6 +233,7 @@ class FilesPipeline(MediaPipeline):
         s3store = cls.STORE_SCHEMES['s3']
         s3store.AWS_ACCESS_KEY_ID = settings['AWS_ACCESS_KEY_ID']
         s3store.AWS_SECRET_ACCESS_KEY = settings['AWS_SECRET_ACCESS_KEY']
+        s3store.POLICY = settings['FILES_STORE_S3_ACL']
 
         cls.FILES_URLS_FIELD = settings.get('FILES_URLS_FIELD', cls.DEFAULT_FILES_URLS_FIELD)
         cls.FILES_RESULT_FIELD = settings.get('FILES_RESULT_FIELD', cls.DEFAULT_FILES_RESULT_FIELD)

scrapy/settings/default_settings.py

@@ -156,6 +156,8 @@ FEED_EXPORTERS_BASE = {
     'pickle': 'scrapy.exporters.PickleItemExporter',
 }
 
+FILES_STORE_S3_ACL = 'private'
+
 HTTPCACHE_ENABLED = False
 HTTPCACHE_DIR = 'httpcache'
 HTTPCACHE_IGNORE_MISSING = False