Restrict Access to S3 bucket on AWS

Question

I am storing files in a S3 bucket. I want the access to the files be restricted.

Currently, anyone with the URL to the file is able to access the file.

I want a behavior where file is accessed only when it is accessed through my application. The application is hosted on EC2.

Following are 2 possible ways I could find.

1. Use "referer" key in bucket policy.

2. Change "allowed origin" in CORS configuration

Which of the above 2 should be used, given the fact that 'referer' could be spoofed in the request header.

Also can cloudfront play a role over here?

Answer 1

When dealing with a private S3 bucket, you'll want to use an AWS SDK appropriate for your use case.

Here lies SDKs for many different languages: http://aws.amazon.com/tools/

Within each SDK, you can find sample calls to S3.

If you are trying to make private calls via browser-side JavaScript, you can use CORS .

Answer 2

I would recommend using a Pre-Signed URL that permits access to private objects stored on Amazon S3. It is a means of keeping objects secure, yet grant temporary access to a specific object.

It is created via a hash calculation based on the object path, expiry time and a shared Secret Access Key belonging to an account that has permission to access the Amazon S3 object. The result is a time-limited URL that grants access to the object . Once the expiry time passes, the URL does not return the object.

Start by removing existing permissions that grant access to these objects. Then generate Pre-Signed URLs to grant access to private content on a per-object basis, calculated every time you reference an S3 object. (Don't worry, it's fast to do!)

See documentation: Sample code in Java