Amazon S3 - Restrict Access by referer

Question

I have a bucket policy for restricting access of files with "--original" in the filename, but it only works if you put in the URL directly into the browser. If you click "open image in new tab" then it shows up just fine (I assume because the http referer is indeed from that site). I need to give access to the website to show the image, but if in a new tab or trying to download, it doesn't get access. Do I need to put some sort of redirect in?

Here's my bucket policy:

{
    "Version": "2012-10-17",
    "Id": "Deny file access",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion"
            ],
            "Resource": "arn:aws:s3:::examplebucket/*--original*",
            "Condition": {
                "StringNotLike": {
                    "aws:Referer": [
                        "https://examplebucket.com*",
                        "https://examplebucket.dev*"
                    ]
                }
            }
        }
    ]
}

Answer 1

Controlling access via referer is not very secure. It can easily be spoofed. Do not use it to protect confidential information.

Instead, your application should generate an Amazon S3 pre-signed URLs, which provides time-limited access to a private object.

Answer 2

By default, all S3 resources are private. So if there is not an Allow rule in the policy, it will deny by default. And if there's any Deny rule that matches the request then the request will be denied, even if the request is allowed by other rules.

Try the following:

{
    "Version": "2012-10-17",
    "Id": "Deny file access",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion"
            ],
            "Resource": "arn:aws:s3:::examplebucket/*"
        },
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion"
            ],
            "Resource": "arn:aws:s3:::examplebucket/*--original*",
            "Condition": {
                "StringNotLike": {
                    "aws:Referer": [
                        "https://examplebucket.com*",
                        "https://examplebucket.dev*"
                    ]
                }
            }
        }
    ]
}