4

I tried preventing hotlinking media files on Amazon S3 with this bucket policy. 

{
"Version": "2008-10-17",
"Id": "my-id",
"Statement": [
    {
        "Sid": "Allow get requests to specific referrers",
        "Effect": "Allow",
        "Principal": {
            "AWS": "*"
        },
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::bucketname/*",
        "Condition": {
            "StringLike": {
                "aws:Referer": "http://sitename.com/"
            }
        }
    },
    {
        "Sid": "Allow CloudFront get requests",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::amazonaccountid:root"
        },
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::bucketname/*"
    }
]
}

The ACL is set to private. I am still unable to get it to accept the files that I am trying to access.

I tried many different policies that I found here but none of them seem to have any effect. The files that I am trying to prevent from hotlinking are .swf files.

When I use the exact (bucketname.s3.amazonaws.com) link without the cloudfront, it works.

pb2q
  • 58,613
  • 19
  • 146
  • 147
Row1e
  • 101
  • 8
  • -@Roy did you solve your problem yet? I've got largely the [same problem](http://stackoverflow.com/questions/11522563/prevent-hotlinking-of-amazon-s3-content) so wanted to see what your current status is – tim peterson Jul 17 '12 at 13:06
  • 2
    S3 bucket policies have no effect on Amazon CloudFront. Check this out http://stackoverflow.com/questions/5652962/preventing-amazon-cloudfront-hotlinking – Michel Feldheim Nov 25 '12 at 23:27

1 Answers1

4

Here is the bucket policy I used that got it to work.

{
"Version": "2008-10-17",
"Id": "http referer policy",
"Statement": [
    {
        "Sid": "Allow get requests referred by www.mysite.com and mysite.com",
        "Effect": "Allow",
        "Principal": "*",
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::bucketname/*",
        "Condition": {
            "StringLike": {
                "aws:Referer": "http://www.mysite.com/*"
            }
        }
    }
]

}

Row1e
  • 101
  • 8