title: Suspicious Operation trying to upload local image to S3 in Django
body: <p>I'm developing a Django project where my Users have a profile picture saved as an ImageField, which I currently store in S3. </p>
  
  <pre><code>class MyUser(models.Model):
      user = models.OneToOneField(User, unique=True)
      picture = models.ImageField(max_length=255, upload_to=get_user_pic_path)
  
  def get_user_pic_path(instance, filename):
      return os.path.join('user_pics', instance.user.username, filename)
  </code></pre>
  
  <p>with the relevant <code>settings.py</code>:</p>
  
  <pre><code># Amazon S3 stuff
  AWS_ACCESS_KEY_ID = os.environ['AWS_ACCESS_KEY_ID']
  AWS_SECRET_ACCESS_KEY = os.environ['AWS_SECRET_ACCESS_KEY']
  AWS_STORAGE_BUCKET_NAME = os.environ['AWS_STORAGE_BUCKET_NAME']
  AWS_S3_CUSTOM_DOMAIN = '%s.s3.amazonaws.com' % AWS_STORAGE_BUCKET_NAME
  
  AWS_LOCATION = 'static'
  MEDIAFILES_LOCATION = 'media'
  
  # URL prefix for static files.
  STATIC_ROOT = '/%s/' % AWS_LOCATION
  STATIC_URL = '//%s/%s/' % (AWS_S3_CUSTOM_DOMAIN, AWS_LOCATION)
  STATICFILES_STORAGE = 'storages.backends.s3boto3.S3Boto3Storage'
  
  STATICFILES_DIRS = [
      os.path.join(BASE_DIR, 'static'),
  ]
  
  # Media urls
  MEDIA_ROOT = '/%s/' % MEDIAFILES_LOCATION
  MEDIA_URL = '//%s/%s/' % (AWS_S3_CUSTOM_DOMAIN, MEDIAFILES_LOCATION)
  DEFAULT_FILE_STORAGE = 'storages.backends.s3boto3.S3Boto3Storage'
  </code></pre>
  
  <p>The project works in production, which allows users to create accounts by taking a webcam photo and saving that to S3, but I get a <code>SuspiciousOperation</code> when trying to set up a local user for testing purposes. I have a command that is invoked by <code>python manage.py create_test_user</code>, which does:</p>
  
  <pre><code>def handle(self, *args, **options):
      pic_path = os.path.join(settings.BASE_DIR, 'static', 'img', 'test_img.jpg')
  
      user_list, pic_list = [], []
      for i in range(5):
          # create user objects associated with each MyUser
          u = User.objects.create_user(
              username='bickeree_'+str(i),
              email=str(i)+'@gmail.com',
              password='1234'
          )
          u.first_name = 'Test User'
          u.last_name = str(i)
          u.save()
  
          # we store the picture so we can properly close it
          pic_list.append(File(open(pic_path, 'rb')))
          user_list.append(MyUser(
              user=u,
              picture=pic_list[-1],
          ))
  
      # create all of the MyUser objects
      MyUser.objects.bulk_create(user_list)
  
      # clean up the images
      for pic in pic_list:
          pic.close()
  </code></pre>
  
  <p>Running this command results in:</p>
  
  <pre><code>django.core.exceptions.SuspiciousOperation: Attempted access to '/Users/username/Documents/projectname/static/img/test_img.jpg' denied.
  </code></pre>
  
  <p>How to get around this error?</p>