AWS S3: Unable to restrict access to bucket resources only on my website

Viewed 28

According to the documentation, all I have to do is add this S3 bucket policy:

{
  "Version":"2012-10-17",
  "Id":"http referer policy example",
  "Statement":[
    {
      "Sid":"Allow get requests originating from www.example.com and example.com.",
      "Effect":"Allow",
      "Principal":"*",
      "Action":["s3:GetObject","s3:GetObjectVersion"],
      "Resource":"arn:aws:s3:::DOC-EXAMPLE-BUCKET/*",
      "Condition":{
        "StringLike":{"aws:Referer":["http://www.example.com/*","http://example.com/*"]}
      }
    }
  ]
}

So I went to my bucket and I found these existing policies:

{
    "Version": "2008-10-17",
    "Id": "Policy1335892530063",
    "Statement": [
        {
            "Sid": "Stmt1335892150622",
            "Effect": "Allow",
            "Principal": {
                "Service": "billingreports.amazonaws.com"
            },
            "Action": [
                "s3:GetBucketAcl",
                "s3:GetBucketPolicy"
            ],
            "Resource": "arn:aws:s3:::bucket-name",
            "Condition": {
                "StringEquals": {
                    "aws:SourceArn": "arn:aws:cur:us-east-1:122xxxxxx328:definition/*",
                    "aws:SourceAccount": "122xxxxx328"
                }
            }
        },
        {
            "Sid": "Stmt1335892526596",
            "Effect": "Allow",
            "Principal": {
                "Service": "billingreports.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::bucket-name/*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceArn": "arn:aws:cur:us-east-1:122xxxxx328:definition/*",
                    "aws:SourceAccount": "122xxxxx5328"
                }
            }
        }
    ]
}

So I added this one:

{
    "Sid": "Allow get requests originating from www.mywebsite.com and mywebsite.com.",
    "Effect": "Allow",
    "Principal": "*",
    "Action": [
        "s3:GetObject",
        "s3:GetObjectVersion"
    ],
    "Resource": "arn:aws:s3:::bucket-name/*",
    "Condition": {
        "StringLike": {
            "aws:Referer": [
                "https://www.mywebsite.com/*",
                "https://mywebsite.com/*"
            ]
        }
    }
}

And so this is the final result:

{
    "Version": "2008-10-17",
    "Id": "Policy1335892530063",
    "Statement": [
        {
            "Sid": "Stmt1335892150622",
            "Effect": "Allow",
            "Principal": {
                "Service": "billingreports.amazonaws.com"
            },
            "Action": [
                "s3:GetBucketAcl",
                "s3:GetBucketPolicy"
            ],
            "Resource": "arn:aws:s3:::bucket-name",
            "Condition": {
                "StringEquals": {
                    "aws:SourceArn": "arn:aws:cur:us-east-1:122xxxxxx328:definition/*",
                    "aws:SourceAccount": "122xxxxx328"
                }
            }
        },
        {
            "Sid": "Stmt1335892526596",
            "Effect": "Allow",
            "Principal": {
                "Service": "billingreports.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::bucket-name/*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceArn": "arn:aws:cur:us-east-1:122xxxxx328:definition/*",
                    "aws:SourceAccount": "122xxxxx5328"
                }
            }
        },
        {
            "Sid": "Allow get requests originating from www.mywebsite.com and mywebsite.com.",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion"
            ],
            "Resource": "arn:aws:s3:::bucket-name/*",
            "Condition": {
                "StringLike": {
                    "aws:Referer": [
                        "https://www.mywebsite.com/*",
                        "https://mywebsite.com/*"
                    ]
                }
            }
        }
    ]
}

But, still the resources wouldn't load on mywebsite.
Any idea what's going on or what I should check to debug this?

0 Answers
Related