如何使用IAM和CORS正确保护S3？

Question

I've figured out how to set up CORS and IAM so I post images to and display images from S3. I have two main issues.

1. What I have seems insecure because from my understanding of what I have, anyone could access it.
2. If I secure it, I can no longer test properly on localhost. And I don't have the option of setting it to be accessible on localhost from a work network because we're all remote.

Policy

    {"Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AddPerm",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:PutObjectAcl",
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-name",
                "arn:aws:s3:::bucket-name/*"
            ]
        },
        {
            "Sid": "read only policy",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::bucket-name/*"
        }
    ]}

CORS

<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
    <CORSRule>
        <AllowedOrigin>*</AllowedOrigin>
        <AllowedMethod>GET</AllowedMethod>
        <AllowedMethod>POST</AllowedMethod>
        <AllowedMethod>PUT</AllowedMethod>
        <AllowedMethod>HEAD</AllowedMethod>
        <MaxAgeSeconds>3000</MaxAgeSeconds>
        <AllowedHeader>*</AllowedHeader>
    </CORSRule>
</CORSConfiguration>

So, how do I secure my configurations while still allowing development from localhost?

Will using "Condition": {"StringLike": {"aws:Referer": [ ... ]}} prevent access from localhost?

Answer 1

You can lock down the S3 bucket without using the Referer tag. It is probably more secure to use it after testing is complete.

In the AWS S3 console, you can grant permissions to access the bucket to yourself. As long as the Grantee does not say 'Everyone', everyone does not have access to the bucket.

You can then generate an IAM access key for yourself in IAM > Users > 'user_name'. This key can be used to authenticate with the bucket.
You will also want to grant the user the AmazonS3FullAccess by attaching it as a policy.

You should be able to use the user's credentials that you just generated to access and modify files in S3.