Overview
If you're using Amazon S3 as your image storage provider, your bucket must be configured so that uploaded images are publicly accessible (or accessible through a public CDN).
If Unlayer cannot access the uploaded image, image uploads may fail or return an "Invalid response from upstream" error.
Common Symptoms
You may encounter one or more of the following:
Image uploads fail.
Images do not appear in the Image Library.
The Image Tool returns a 422 - Invalid response from upstream error.
Opening the uploaded image URL directly returns an Access Denied (403) error.
Why This Happens
After an image is uploaded, Unlayer needs to access the uploaded image using its public URL.
If the image URL is not publicly accessible, Unlayer cannot validate or process the uploaded image.
A common cause is an S3 bucket that allows uploads but does not allow public read access to the uploaded objects.
How to Verify Your Configuration
After uploading an image:
Copy the image URL.
Open the URL directly in your browser.
If the image loads successfully, your configuration is likely correct.
If you receive a 403 Access Denied error, your bucket permissions need to be reviewed.
AWS S3 Configuration
If you're hosting images directly from Amazon S3, make sure that:
Your bucket allows public access to uploaded objects or
You're serving images through a publicly accessible CDN such as Amazon CloudFront.
Simply disabling the Block Public Access settings is not sufficient. Your uploaded objects must also be readable through your bucket policy or another public access mechanism.
Using Amazon CloudFront
If you're serving your S3 bucket through Amazon CloudFront or another CDN, your S3 bucket does not need to expose objects publicly, provided the CDN is correctly configured to serve the uploaded images.
This is the recommended approach for many production environments.
Frequently Asked Questions
Why do I receive "Invalid response from upstream"?
This usually indicates that Unlayer could not access the uploaded image using the URL provided by your storage provider.
Why does my image URL return 403 Access Denied?
This typically means the uploaded object is not publicly accessible. Review your S3 bucket policy, object permissions, or CDN configuration.
Is disabling Block Public Access enough?
No.
Disabling Block Public Access only allows public permissions to be applied. It does not automatically make uploaded objects publicly readable.
Do I need to make my bucket public?
Not necessarily.
You can either:
Configure your bucket so uploaded images are publicly readable, or
Serve your images through a public CDN such as Amazon CloudFront.
Both approaches are supported, as long as the image URL is accessible by Unlayer.
Best Practices
Verify that uploaded image URLs are accessible from a browser.
Test your configuration before deploying to production.
If using Amazon S3 directly, ensure uploaded objects are publicly readable.
Consider using Amazon CloudFront or another CDN for improved performance and security.