403 forbidden error in vhost

Question

I have a problem with Apache 2.4 and a Drupal 8 site. I get a 403 error only with the default .htaccess file Drupal 8 has.

It only works after I put Options +SymLinksIfOwnerMatch in the .htaccess file, but I don't want to do that way because, everytime I update the site, I have to edit the rewrite rules. I don't want to set the file permissions of that file to 555.

I am using Apache 2.4 with vhosts and this is my file without SSL.

# VirtualHost template
# Note: to use the template, rename it to /etc/apache2/vhost.d/yourvhost.conf. 
# Files must have the .conf suffix to be loaded.
#
# See /usr/share/doc/packages/apache2/README.QUICKSTART for further hints 
# about virtual hosts.
#
# NameVirtualHost statements can be added to /etc/apache2/listen.conf.
#
# Almost any Apache directive may go into a VirtualHost container.
# The first VirtualHost section is used for requests without a known
# server name.
#
<VirtualHost *:80>
    ServerAdmin [email protected]
    ServerName example.com
    ServerAlias www.example.com

    Redirect permanent / https://www.example.com/    

    # DocumentRoot: The directory out of which you will serve your
    # documents. By default, all requests are taken from this directory, but
    # symbolic links and aliases may be used to point to other locations.
    DocumentRoot /srv/www/vhosts/example

    # if not specified, the global error log is used
    ErrorLog /var/log/apache2/example-error_log
    CustomLog /var/log/apache2/example-access_log combined


    # don't loose time with IP address lookups
    HostnameLookups Off

    # needed for named virtual hosts
    UseCanonicalName Off

    # configures the footer on server-generated documents
    ServerSignature On


    # Optionally, include *.conf files from /etc/apache2/conf.d/
    #
    # For example, to allow execution of PHP scripts:
    #
    # Include /etc/apache2/conf.d/php5.conf
    #
    # or, to include all configuration snippets added by packages:
    # Include /etc/apache2/conf.d/*.conf


    # ScriptAlias: This controls which directories contain server scripts.
    # ScriptAliases are essentially the same as Aliases, except that
    # documents in the realname directory are treated as applications and
    # run by the server when requested rather than as documents sent to the client.
    # The same rules about trailing "/" apply to ScriptAlias directives as to
    # Alias.
    #
    ScriptAlias /cgi-bin/ "/srv/www/vhosts/example/cgi-bin/"

    # "/srv/www/cgi-bin" should be changed to whatever your ScriptAliased
    # CGI directory exists, if you have one, and where ScriptAlias points to.
    #
   <Directory "/srv/www/vhosts/example/cgi-bin">
    AllowOverride All
    Options +ExecCGI -Includes
       <IfModule !mod_access_compat.c>
            Require all granted
       </IfModule>
       <IfModule mod_access_compat.c>
        Order allow,deny
        Allow from all
    </IfModule>
    </Directory>


    # UserDir: The name of the directory that is appended onto a user's home
    # directory if a ~user request is received.
    #
    # To disable it, simply remove userdir from the list of modules in APACHE_MODULES
    # in /etc/sysconfig/apache2.
    #
    <IfModule mod_userdir.c>
    # Note that the name of the user directory ("public_html") cannot simply be
    # changed here, since it is a compile time setting. The apache package
    # would have to be rebuilt. You could work around by deleting
    # /usr/sbin/suexec, but then all scripts from the directories would be
    # executed with the UID of the webserver.
    UserDir public_html
    # The actual configuration of the directory is in
    # /etc/apache2/mod_userdir.conf.
    Include /etc/apache2/mod_userdir.conf
    # You can, however, change the ~ if you find it awkward, by mapping e.g.
    # http://www.example.com/users/karl-heinz/ --> /home/karl-heinz/public_html/
    #AliasMatch ^/users/([a-zA-Z0-9-_.]*)/?(.*) /home/$1/public_html/$2
    </IfModule>


    #
    # This should be changed to whatever you set DocumentRoot to.
    #
    <Directory "/srv/www/vhosts/example">

    #
    # Possible values for the Options directive are "None", "All",
    # or any combination of:
    # Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
    #
    # Note that "MultiViews" must be named *explicitly* --- "Options All"
    # doesn't give it to you.

    # The Options directive is both complicated and important.  Please see
    # http://httpd.apache.org/docs/2.4/mod/core.html#options
    # for more information.
    #
    Options Indexes FollowSymLinks

    #
    # AllowOverride controls what directives may be placed in .htaccess files.
    # It can be "All", "None", or any combination of the keywords:
    #   Options FileInfo AuthConfig Limit
    #
    AllowOverride All

    #
    # Controls who can get stuff from this server.
    #
    <IfModule !mod_access_compat.c>
        Require all granted
    </IfModule>
    <IfModule mod_access_compat.c>
        Order allow,deny
        Allow from all
    </IfModule>

    </Directory>

</VirtualHost>

And this is with SSL

# Template for a VirtualHost with SSL
# Note: to use the template, rename it to /etc/apache2/vhost.d/yourvhost.conf.
# Files must have the .conf suffix to be loaded.
#
# See /usr/share/doc/packages/apache2/README.QUICKSTART for further hints
# about virtual hosts.

# NameVirtualHost statements should be added to /etc/apache2/listen.conf.

#
# This is the Apache server configuration file providing SSL support.
# It contains the configuration directives to instruct the server how to
# serve pages over an https connection. For detailing information about these 
# directives see http://httpd.apache.org/docs/2.4/mod/mod_ssl.html
#
# Do NOT simply read the instructions in here without understanding
# what they do.  They're here only as hints or reminders.  If you are unsure
# consult the online docs. You have been warned.  
#

<IfDefine SSL>
<IfDefine !NOSSL>

##
## SSL Virtual Host Context
##

<VirtualHost *:443>

    #  General setup for the virtual host
    DocumentRoot "/srv/www/vhosts/example"
    ServerName example.com:443
        ServerAlias www.example.com:443

    ServerAdmin [email protected]
    ErrorLog /var/log/apache2/example_ssl_error_log
    TransferLog /var/log/apache2/example_ssl_access_log

    #   SSL Engine Switch:
    #   Enable/Disable SSL for this virtual host.
    SSLEngine on

    #   You can use per vhost certificates if SNI is supported.
        SSLCertificateFile /etc/apache2/ssl.crt/STAR_example.crt
        SSLCertificateKeyFile /etc/apache2/ssl.key/example.key
        SSLCertificateChainFile /etc/apache2/ssl.crt/STAR_example.ca-bundle

    #   Per-Server Logging:
    #   The home of a custom SSL log file. Use this when you want a
    #   compact non-error SSL logfile on a virtual host basis.
        CustomLog /var/log/apache2/example_ssl_request_log   ssl_combined
</VirtualHost>

</IfDefine>
</IfDefine>

In Drupal 7, it works fine that way, but I cannot make it work with Drupal 8.

So I want to set up the Apache vhosts to avoid any 403 error when I update.