Active Storage services default to private access, unless you specifically make them public.
By default, Active Storage assumes private access to services. This means generating signed, single-use URLs for blobs. If you'd rather make blobs publicly accessible, specify public: true in your app's config/storage.yml
But sometimes apps need both private...
class Account < ApplicationRecord
has_one_attached :logo, service: storage_service(:amazon_public)
has_one_attached :report, service: storage_service(:amazon_private)