AWS S3: How to make sure S3 resources are only accessible on website if aws:Referer can be spoofed?

AG_HIHI 0
Viewed 58

In order to make S3 resources only accessible on my website, I can use this S3 policy:

{
  "Version":"2012-10-17",
  "Id":"http referer policy example",
  "Statement":[
    {
      "Sid":"Allow get requests originating from www.example.com and example.com.",
      "Effect":"Allow",
      "Principal":"*",
      "Action":["s3:GetObject","s3:GetObjectVersion"],
      "Resource":"arn:aws:s3:::DOC-EXAMPLE-BUCKET/*",
      "Condition":{
        "StringLike":{"aws:Referer":["http://www.example.com/*","http://example.com/*"]}
      }
    }
  ]
}

However, according to the documentation:
enter image description here

The purpose of this policy is more like "Preventing third-party websites from accessing the content" rather than "absolutely preventing anyone from accessing the S3 data" since the policy is based on "aws:Referer" and that can be spoofed (See image above).

So how do I really ensure the S3 resources are absolutely only accessible on my website and no unauthorized party can access them?

Note: My website is hosted on AWS EC2.

amazon-s3 amazon-web-services
1 Answers

  1. The public read access to the S3 bucket should be removed. Use CloudFront as a global content delivery network (CDN) for the photos and use expired Signed URLs.

  2. Create custom Signed URL policy, -https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-creating-signed-url-custom-policy.html

     {
     "Statement": [
         {
             "Resource": "URL or stream name of the file",
             "Condition": {
                 "DateLessThan": {
                     "AWS:EpochTime": required ending date and time in Unix time format and UTC
                 },
                 "DateGreaterThan": {
                     "AWS:EpochTime": optional beginning date and time in Unix time format and UTC
                 },
                 "IpAddress": {
                     "AWS:SourceIp": "optional IP address"
                 }
             }
         }
     ]
 }

  3. Use signed cookies also are supported for authentication. This mechanism could be used to grant limited access to a CloudFront website for select users

  1. Finally Give CloudFront an Origin Access Identity (or OAI) OAI prevents users from viewing your S3 files by simply using the direct URL for the file, for example:
vaquar khan0
Related