{"action":"created","issue":{"url":"https://api.github.com/repos/fog/fog-aws/issues/207","labels_url":"https://api.github.com/repos/fog/fog-aws/issues/207/labels{/name}","comments_url":"https://api.github.com/repos/fog/fog-aws/issues/207/comments","events_url":"https://api.github.com/repos/fog/fog-aws/issues/207/events","html_url":"https://github.com/fog/fog-aws/issues/207","id":120839288,"number":207,"title":"Is there any way to skip object level `acl` setting while `public` option is true","user":{"login":"yanke-guo","id":2901289,"avatar_url":"https://avatars.githubusercontent.com/u/2901289?v=3","gravatar_id":"","url":"https://api.github.com/users/yanke-guo","html_url":"https://github.com/yanke-guo","followers_url":"https://api.github.com/users/yanke-guo/followers","following_url":"https://api.github.com/users/yanke-guo/following{/other_user}","gists_url":"https://api.github.com/users/yanke-guo/gists{/gist_id}","starred_url":"https://api.github.com/users/yanke-guo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yanke-guo/subscriptions","organizations_url":"https://api.github.com/users/yanke-guo/orgs","repos_url":"https://api.github.com/users/yanke-guo/repos","events_url":"https://api.github.com/users/yanke-guo/events{/privacy}","received_events_url":"https://api.github.com/users/yanke-guo/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-07T18:40:24Z","updated_at":"2015-12-21T16:43:15Z","closed_at":"2015-12-21T16:43:14Z","body":"I've set up bucket level `acl` to private, and add a policy to allow anonymous read from specified HTTP Referer header.\r\n\r\nNow I have a problem, if I set `public` option to false, all urls will be signed, that is a waste, but if I set `public` to true, fog will add object level `public-read` `acl`, which will override HTTP Referer policy.\r\n\r\nTo solve this I have to write two policies\r\n\r\nFirst, a `Allow` policy to allow anonymous read from my site.\r\nSecond, a `Deny` policy to disable anonymous read outside of my site, with IAM user permitted.\r\n\r\nLike this https://gist.github.com/yanke-guo/38d023f984330760d2ae\r\n"},"comment":{"url":"https://api.github.com/repos/fog/fog-aws/issues/comments/166355132","html_url":"https://github.com/fog/fog-aws/issues/207#issuecomment-166355132","issue_url":"https://api.github.com/repos/fog/fog-aws/issues/207","id":166355132,"user":{"login":"geemus","id":4138,"avatar_url":"https://avatars.githubusercontent.com/u/4138?v=3","gravatar_id":"","url":"https://api.github.com/users/geemus","html_url":"https://github.com/geemus","followers_url":"https://api.github.com/users/geemus/followers","following_url":"https://api.github.com/users/geemus/following{/other_user}","gists_url":"https://api.github.com/users/geemus/gists{/gist_id}","starred_url":"https://api.github.com/users/geemus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/geemus/subscriptions","organizations_url":"https://api.github.com/users/geemus/orgs","repos_url":"https://api.github.com/users/geemus/repos","events_url":"https://api.github.com/users/geemus/events{/privacy}","received_events_url":"https://api.github.com/users/geemus/received_events","type":"User","site_admin":false},"created_at":"2015-12-21T16:43:14Z","updated_at":"2015-12-21T16:43:14Z","body":"I think what you describe is probably your best bet. The `public` option is meant to make it easy in the trivial/simple case, but is not really sufficiently powerful to capture more complicated cases such as yours."}}