How Do I Secure My Amazon S3 Buckets

Question

I have Amazon S3, which contains a bunch of my videos (for Internet Marketing). I also have images, scripts, packaged courses, video tutorials, all kinds of stuff. All the files are sorted through different folders inside my Amazon bucket.

The issue is, all the files are easily available to anyone using some Amazon S3 Bucket ripping programs. You just enter the bucket name, and boom you can just rip everything. I also received an email from Amazon a little while back about my bucket being insecure and publicly accessible.

I guess I have to setup some bucket policy?

I need the ability to embed the videos on my various web sites (video squeeze pages). Also with my training area, it too has embedded video tutorials, as well as some zip files for members to download, ect. Also my JWPlayer SWF controller file and the matching jwplayer.js file, are both located on my Amazon S3 (so that it loads fast, and all my video embeds use it, so I don't have jwplayer uploaded 20 different times across many sites).

How am I going to not make the Bucket publicly accessible, but yet it still can embed on my pages. I can't set it to only allow a domain, because it will be used across many sites. I could allow it from the IP of my server? If I did have it use the domain, I could have 1 site as the redirect just to set the referrer. Like a controlling PHP file that has permission to access the S3...

Any help, links, insight on how I can get this working and secured would be great. Thanks in advance!

Answer 1

You need to create special links that you only share on your pages and that have a time limit on them. That way, if the links get out on the web, they only last a few seconds, minutes, or hours. In my case I created a membership website where one had to login to get the links. Even then, if those members cut/paste those links on the web, the links are dead within a half-hour.

I talk about a function I created for this in PHP here . More info is here .

My function in PHP works, but it doesn't handle subfolders yet and that's why I placed a stackoverflow question ticket on it.