如何为 IP 地址设置 Amazon S3 策略

Question

I am using an S3-compatible storage (digital ocean spaces) to host images from my web application. To prevent hotlinking and minimize direct downloads I applied this policy:

{
   "Id": ip referer policy example",
   "Statement": [
    {
       "Sid": "Allow get requests originating from my server.",
       "Effect": "Deny",
       "Principal": "*",
       "Action": "s3:GetObject",
       "Resource": "arn:aws:s3:::bucket-name/*",
       "Condition": {
         "NotIpAddress":  {
          "aws:SourceIp":  "server-ip-address"
        }
      }
    } 
  ]
}

The trick seemed to work and I am now unable to access the files directly, however, neither can my web application. Have I done something wrong?

Is there a way to debug a referrer or something?

Answer 1

Content is private by default. Your policy is not granting any access via an Allow statement, so the content is not accessible. The Deny can be used to remove permissions granted by an Allow , but does not itself grant access.

You could change it into an Allow policy, and change NotIpAddress into IpAddress . This would grant access to your server to download content. However, it would be better to use an S3-style API call to download content from your own bucket rather than using an anonymous HTTP request.

If you are putting a link to the object in an HTML page, then the policy will provide the security that you expect because the user's browser will attempt to access the object and it will be denied access since the request is not originating from your server's IP address.