CODEWITHSUNDEEP
amazon-web-servicesamazon-s3
Camil
Camil

Reputation: 33

Restrict read-write access from my S3 bucket

I am hosting a website where users can write and read files, which are stored into another S3 Bucket. However, I want to restrict the access of these files only to my website.

For example, loading a picture.

Right now, even with all I have tried, people can access ressources from the Object URL.

Here is my Bucket Policy:

{
    "Version": "2012-10-17",
    "Id": "Id",
    "Statement": [
        {
            "Sid": "Sid",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:GetObjectAcl"
            ],
            "Resource": "arn:aws:s3:::storage-bucket/*",
            "Condition": {
                "StringLike": {
                    "aws:Referer": "http://example.com/*"
                }
            }
        }
    ]
}

Additionnal informations:

If you need more informations or details, ask me.

Thank you in advance for your answers.

This message has been written by a French speaking guy. Sorry for the mistakes

Upvotes: 0

Views: 1362

Answers (1)

gusto2
gusto2

Reputation: 12087

"aws:Referer": "http://example.com/*

The referer is an http header passed by the browser and any client could just freely set the value. It provides no real security

However, I want to restrict the access of these files only to my website

Default way restrict access to S3 resources for a website is using the pre-signed url. Basically your website backend can create an S3 url to download or upload an s3 object and pass the url only to authenticated /allowed client. Then your resource bucket can restrict the public access. Allowing upload without authentication is usually a very bad idea.

Yes, in this case your website is not static anymore and you need some backend logic to do so.

If your website clients are authenticated, you may use the AWS API Gateway and Lambda to create this pre-signed url for the clients.

Upvotes: 2

Related Questions