AWS S3 Bucket Policy security

Question

I have a website where the users can upload files like images or pdfs, and I'm storing them in AWS S3. It's working correctly, but I put a "public policy" to test it like this one:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AddPerm",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::mybucket/*"
            ]
        }
    ]
}

It works but I think that a malicius user could make a lot of requests and amazon charge me for that. So what would be the way to limit the access but keep working correctly with my webapp?

Thanks in advance.

Answer 1

You could create a time-limited Amazon S3 pre-signed URL for those objects. This grants access to a private object for a limited time.

Answer 2

You can Restrict Access to Specific HTTP Referrer by modifying your bucket policy like this.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AddPerm",
      "Effect": "Allow",
      "Principal": "*",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::mybucket/*"
      ],
      "Condition": {
        "StringLike": {
          "aws:Referer": [
            "http://www.example.com/*",
            "http://example.com/*"
          ]
        }
      }
    }
  ]
}

Replace example.com with your website name.This allows the objects can be only accessed from domain staring with your domain name. Make sure the browsers you use include the http referer header in the request . For more details see Restricting Access to a Specific HTTP Referrer