title: amazon S3 bucket policy - restricting access by referer BUT not restricting if urls are generated via query string authentication
body: <p>I have the following bucket policy set on my bucket: </p>
  
  <pre><code>{
  
  "Version": "2008-10-17",
  
  "Id": "My access policy",
  
  "Statement": [
  
       {
  
   "Sid": "Allow only requests from our site",
  
   "Effect": "Allow",
  
   "Principal": { "AWS": "*"},
  
   "Action": "s3:GetObject",
  
   "Resource": "arn:aws:s3:::my_bucket/*",
  
   "Condition": {
  
     "StringLike": {
  
        "aws:Referer": [" http://mydomain.com/*"," http://www.mydomain.com/*"]
  
          }
  
                }
  
   },
  
  {
  
     "Sid": "Dont allow direct acces to files  when no referer is present",
  
     "Effect": "Deny",
  
     "Principal": {"AWS": "*" },
  
    "Action": "s3:GetObject",
  
    "Resource": "arn:aws:s3:::my_bucket/*",
  
    "Condition": {
  
    "Null": {"aws:Referer": true }
  
           }
  
           }
  
  ]
  
    }
  </code></pre>
  
  <p>I also configured <a href="http://s3.amazonaws.com/quotes/nelson?AWSAccessKeyId=44CF9590006BF252F707&amp;Expires=1141889120&amp;Signature=vjbyPxybdZaNmGa%2byT272YEAiv4=" rel="noreferrer">query string authentication</a>, but it looks like I can't have both. If I have my bucket policies set to deny any request that doesn't originate from mydomain, my temporary url using query string authentication will also not get served. So my question is, how can i have both ? Is there a way to check for url parameters and see if it has a parameter called "Signature" and in that case not apply the referer policy?</p>