UNCLASSIFIED - NO CUI

Skip to content

Gitlab S3 Configuration Broken for rails key

The gitlab-object-storage secret deployed with Gitlab contains three keys:

  • backups
  • rails
  • registry

At minimum, the rails key in the gitlab-object-storage secret is incorrect, it currently is written as follows:

provider: AWS
region: us-gov-west-1
aws_access_key_id: "[REDACTED]"
aws_secret_access_key: "[REDACTED]"
endpoint: s3.us-gov-west-1.amazonaws.com

The particular key that is wrong is endpoint. The particular documentation for this setting requires the endpoint to be a fully formed URL. This would mean the endpoint should be configured as https://s3.us-gov-west-1.amazonaws.com, with the resulting file looking like the following:

provider: AWS
region: us-gov-west-1
aws_access_key_id: "[REDACTED]"
aws_secret_access_key: "[REDACTED]"
endpoint: "https://s3.us-gov-west-1.amazonaws.com"

What happens if this is misconfigured, is the fog Ruby gem misconfigures itself, and all S3 communication between Gitlab web, and Gitlab sidekiq gets broken, this becomes most apparent with avatar uploads. However, this effects all forms of uploads in Gitlab.