Magento 2 file system permissions problem

[joseph_digiovanna]

For a little while now, I've been dealing with some issues related to file system permissions that are causing problems on the server.  My current setup is as follows:

AWS EC2 instance with default user "ubuntu" (ubuntu 16.04 LTS).

Magento 2.2.3 EE

Apache

Installation root /var/www/html/magento2

I've followed the instructions here: https://devdocs.magento.com/guides/v2.2/install-gde/prereq/file-system-perms.html

But it seems as though it's not sticking, as every time I run 'setup:upgrade' I'm stuck with permissions issues that usually result in a "can't write file" type of output.  I've made sure the ubuntu user is part of the www-group.  I've written a bash script that essentially fixes everything temporarily, but that's obviously not a long term solution (and I've made a few modifications like trying to add a sticky bit on the file / dir permissions).  Here's what it is currently doing.

sudo chown -R ubuntu:www-data /var/www/html

cd /var/www/html/magento2

find var vendor generated pub/static pub/media app/etc -type f -exec chmod u+ws {} \;

find var vendor generated pub/static pub/media app/etc -type d -exec chmod u+ws {} \;

chmod u+x bin/magento

Running this puts things back into working order, but then if I upgrade I'm back to having issues.  Any help would be appreciated, please let me know if there is any other info I can provide.

[Damian Culotta]

Hi @joseph_digiovanna,

Which user are you using to connect and run those commands?

[joseph_digiovanna]

Hey Damian, I'm connecting using a .pem key as user ubuntu.  The ubuntu user has been made part of the www-data group.

[joseph_digiovanna]

As a follow-up, I'm also running all of the bin/magento commands as the ubuntu user.  

[Damian Culotta]

Hi @joseph_digiovanna,

If you run some of the commands of Magento that creates files (for example bin/magento setup:di:compile), who is the owner of those files, the group and the permissions?

Can you confirm if those values are correct?

[joseph_digiovanna]

I ran that as a test and it appears to be creating things as ubuntu:ubuntu with permissions 660.  I believe this then causes Apache (running as www-data:www-data) to have permissions issues.

I've tried running the commands prefixed with "sudo -u www-data" but that doesn't appear to change anything.