Restricting S3 Bucket Files Access to Website Only

Hello,

To access the files in the bucket only by website not other then we need to update the S3 bucket policy. I have researched the issue and get one way and sharing it with you. If there are any issue comment me to help you more :)

{
    "Version": "2012-10-17",
    "Id": "Policy1614793348558",
    "Statement": [
        {
            "Sid": "AllowOnlyWebsiteAccess",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::your-bucket-name/*",
            "Condition": {
                "StringLike": {
                    "aws:Referer": "https://your-website.com/*"
                }
            }
        },
        {
            "Sid": "DenyAllOthers",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::your-bucket-name/*",
            "Condition": {
                "StringNotLike": {
                    "aws:Referer": "https://your-website.com/*"
                }
            }
        }
    ]
}

Update the policy and try it once.

Thank you:)

Thanks for sharing your policy snippet! One thing to check: AWS S3 does not trust the aws:Referer condition alone for security—it’s easy to spoof, so it’s more of a “polite suggestion” than a locked-down rule.

That said, make sure:

You’re serving the files through static site hosting or CloudFront

The site is actually passing the Referer header (use browser dev tools to confirm)

Try StringEquals instead of StringLike if you’re matching exactly:

json

"aws:Referer": "https://www.example.com/" Also double-check that:

The bucket name and region are correct

There are no conflicting deny policies

Let me know if you want help tweaking the policy further!