CODEWITHSUNDEEP
amazon-web-servicesamazon-s3cors
Guilherme Cunha
Guilherme Cunha

Reputation: 49

How to configure CORS on AWS S3?

I am days researching how CORS works on AWS S3 but I can’t configure it at all.

I need my files to NOT be publicly accessible, BUT they can be incorporated into my domains. Currently I am unable to incorporate my images into my domains, access to them is completely blocked, as if CORS did not exist.

AWS Block Public Access

AWS Block Public Access

CORS settings

[
  {
    "AllowedHeaders": ["*"],
    "AllowedMethods": ["GET", "PUT", "POST", "DELETE"],
    "AllowedOrigins": [
      "https://www.dev.seedlix.com.br/",
      "https://dev.seedlix.com.br/",
      "http://www.dev.seedlix.com.br/",
      "http://dev.seedlix.com.br/",
      "https://www.seedlix.com.br/",
      "https://seedlix.com.br/",
      "http://www.seedlix.com.br/",
      "http://seedlix.com.br/",
      "http://localhost:3000/",
      "52.95.163.31:443"
    ],
    "ExposeHeaders": []
  }
]

Upvotes: 0

Views: 768

Answers (1)

Guilherme Cunha
Guilherme Cunha

Reputation: 49

After many hours of research, I finally managed to do what I wanted. First of all, I left all Bucket Accessible, and then I created a Policy that blocks access to EVERYONE except for requests originating from my domains.

Bucket Public Access

Bucket Public Access

Bucket Policy

{
  "Version": "2012-10-17",
  "Id": "http referer policy example",
  "Statement": [
    {
      "Sid": "Allow get requests originating custom domains.",
      "Effect": "Deny",
      "Principal": "*",
      "Action": ["s3:GetObject", "s3:GetObjectVersion"],
      "Resource": "arn:aws:s3:::BUCKET_NAME_HERE/*",
      "Condition": {
        "StringNotLike": {
          "aws:Referer": [
            "https://domain-a.com.br/*",
            "https://domain-b.com/*",
          ]
        }
      }
    }
  ]

Bucket Cors Policy

Bucket Cors Policy

Upvotes: 2

Related Questions