AWS S3 bucket policy - how to allow access only from my website?

amazon-s3, paperclip, ruby-on-rails

Solution

You can check some examples in S3 Documentations

To restrict the access from your web site, you can use the condition on Referrer:

{
  "Version":"2008-10-17",
  "Id":"http referer policy example",
  "Statement":[
    {
      "Sid":"Allow get requests referred by www.mysite.com and mysite.com",
      "Effect":"Allow",
      "Principal":"*",
      "Action":"s3:GetObject",
      "Resource":"arn:aws:s3:::example-bucket/*",
      "Condition":{
        "StringLike":{
          "aws:Referer":[
            " http://www.mysite.com/*",
            " http://mysite.com/*"
          ]
        }
      }
    }
  ]
}

Problem

I have a paperclip text file attachment (in Rails). My bucket policy is: ``` { "Version": "2008-10-17", "Id": "Policy123", "Statement": [ { "Sid": "Stmt123", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": [ "s3:GetObjectVersion", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetObject", "s3:PutObject" ], "Resource": "arn:aws:s3:::my_bucket/*" } ] } ``` I want to restrict access to these actions to only be allowed when the request comes from my website. Is it simply a case of updating this to: "Principal": {"AWS": "mywebsite.com"} ?

Original source