Enterprise security practices with AWS S3 Storage

Hi, We've created a self-hosted version of Outline (v0.73.1). Note that the following is specific to our company. It is by no means a deal breaker for using Outline in most contexts. I am simply reporting issues we had for your consideration. The following is about AWS S3 security practices issues, related to two things: • This single line of code: • The AWS public permissions: The public-read ACL is enforcing image uploads for avatars to be public. We are unsure why and would be happy to get more information. This ACL breached an "enterprise" security policy with our Cyber Security teams and other general Platform Engineering guidelines we have with AWS S3 encryption that is specific to us: we enforced AWS KMS encryption for S3 buckets. While KMS is the most secure encryption, a public ACL cannot work with KMS as you need a key to be able to read a file. As a middle ground, we agreed internally to use AES256 to encrypt for this specific c…