Don't override default ACL already configured on AWS side.

storages/backends/s3boto3.py

@@ -185,8 +185,8 @@ class S3Boto3Storage(Storage):
     object_parameters = setting('AWS_S3_OBJECT_PARAMETERS', {})
     bucket_name = setting('AWS_STORAGE_BUCKET_NAME')
     auto_create_bucket = setting('AWS_AUTO_CREATE_BUCKET', False)
-    default_acl = setting('AWS_DEFAULT_ACL', 'public-read')
-    bucket_acl = setting('AWS_BUCKET_ACL', default_acl)
+    default_acl = setting('AWS_DEFAULT_ACL', None)
+    bucket_acl = setting('AWS_BUCKET_ACL', None)
     querystring_auth = setting('AWS_QUERYSTRING_AUTH', True)
     querystring_expire = setting('AWS_QUERYSTRING_EXPIRE', 3600)
     signature_version = setting('AWS_S3_SIGNATURE_VERSION')
@@ -340,7 +340,10 @@ def _get_or_create_bucket(self, name):
                     #
                     # Also note that Amazon specifically disallows "us-east-1" when passing bucket
                     # region names; LocationConstraint *must* be blank to create in US Standard.
-                    bucket_params = {'ACL': self.bucket_acl}
+                    if self.bucket_acl:
+                        bucket_params = {'ACL': self.bucket_acl}
+                    else:
+                        bucket_params = {}
                     region_name = self.connection.meta.client.meta.region_name
                     if region_name != 'us-east-1':
                         bucket_params['CreateBucketConfiguration'] = {

tests/test_s3boto3.py

@@ -85,7 +85,25 @@ def test_storage_save(self):
             content.file,
             ExtraArgs={
                 'ContentType': 'text/plain',
-                'ACL': self.storage.default_acl,
+            }
+        )
+
+    def test_storage_save_with_acl(self):
+        """
+        Test saving a file with user defined ACL.
+        """
+        name = 'test_storage_save.txt'
+        content = ContentFile('new content')
+        self.storage.default_acl = 'private'
+        self.storage.save(name, content)
+        self.storage.bucket.Object.assert_called_once_with(name)
+
+        obj = self.storage.bucket.Object.return_value
+        obj.upload_fileobj.assert_called_with(
+            content.file,
+            ExtraArgs={
+                'ContentType': 'text/plain',
+                'ACL': 'private',
             }
         )
 
@@ -102,7 +120,6 @@ def test_storage_save_gzipped(self):
             ExtraArgs={
                 'ContentType': 'application/octet-stream',
                 'ContentEncoding': 'gzip',
-                'ACL': self.storage.default_acl,
             }
         )
 
@@ -120,7 +137,6 @@ def test_storage_save_gzip(self):
             ExtraArgs={
                 'ContentType': 'text/css',
                 'ContentEncoding': 'gzip',
-                'ACL': self.storage.default_acl,
             }
         )
         args, kwargs = obj.upload_fileobj.call_args
@@ -148,7 +164,6 @@ def test_storage_save_gzip_twice(self):
             ExtraArgs={
                 'ContentType': 'text/css',
                 'ContentEncoding': 'gzip',
-                'ACL': self.storage.default_acl,
             }
         )
         args, kwargs = obj.upload_fileobj.call_args
@@ -207,6 +222,23 @@ def test_auto_creating_bucket(self):
         self.storage._connections.connection.Bucket.return_value = Bucket
         self.storage._connections.connection.meta.client.meta.region_name = 'sa-east-1'
 
+        Bucket.meta.client.head_bucket.side_effect = ClientError({'Error': {},
+                                                                  'ResponseMetadata': {'HTTPStatusCode': 404}},
+                                                                 'head_bucket')
+        self.storage._get_or_create_bucket('testbucketname')
+        Bucket.create.assert_called_once_with(
+            CreateBucketConfiguration={
+                'LocationConstraint': 'sa-east-1',
+            }
+        )
+
+    def test_auto_creating_bucket_with_acl(self):
+        self.storage.auto_create_bucket = True
+        self.storage.bucket_acl = 'public-read'
+        Bucket = mock.MagicMock()
+        self.storage._connections.connection.Bucket.return_value = Bucket
+        self.storage._connections.connection.meta.client.meta.region_name = 'sa-east-1'
+
         Bucket.meta.client.head_bucket.side_effect = ClientError({'Error': {},
                                                                   'ResponseMetadata': {'HTTPStatusCode': 404}},
                                                                  'head_bucket')