title: Restrict access to S3 static website that uses API Gateway as a proxy
body: <p>I have an S3 bucket that acts as a static website and I am using API Gateway to distribute traffic to it.  I understand CloudFront is a better option here, but please do not suggest it.  It is not an option, due to reasons I won't go into.</p>
  
  <p>I am accomplishing my solution by configuring a {proxy+} resource.  Image below:</p>
  
  <p><a href="https://i.stack.imgur.com/FB7pn.png" rel="noreferrer"><img src="https://i.stack.imgur.com/FB7pn.png" alt="enter image description here"></a></p>
  
  <p><strong>I would like to only allow access to the S3 website from the API Gateway proxy resource.</strong>  Is there a way I can provide an execution role to the proxy resource, similarly to how you can provide an execution role to a resource to runs a lambda function? Lambda execution role example below:</p>
  
  <p><a href="https://i.stack.imgur.com/yw4Om.png" rel="noreferrer"><img src="https://i.stack.imgur.com/yw4Om.png" alt="enter image description here"></a></p>
  
  <p>The integration request portion of the proxy resource doesn't seem to have an execution role:</p>
  
  <p><a href="https://i.stack.imgur.com/riSPj.png" rel="noreferrer"><img src="https://i.stack.imgur.com/riSPj.png" alt="enter image description here"></a></p>
  
  <p>Or is there a way I can assign a role to the entire API Gateway to provide it the right to access the S3 bucket?</p>
  
  <p>Other things I have tried:</p>
  
  <ol>
  <li><p>Editing the bucket policy to only allow traffic from the API gateway service:</p>
  
  <p>{
      "Version": "2012-10-17",
      "Id": "apiGatewayOnly",
      "Statement": [
          {
              "Sid": "apiGW",
              "Effect": "Allow",
              "Principal": {
          "Service": ["api-gateway-amazonaws.com"] 
      },
              "Action": "s3:GetObject",
              "Resource": "<a href="http://test-proxy-bucket-01.s3-website.us-east-2.amazonaws.com/" rel="noreferrer">http://test-proxy-bucket-01.s3-website.us-east-2.amazonaws.com/</a>*"
          }
      ]
  }</p></li>
  <li><p>Editing the bucket policy to only allow traffic from API Gateway's URL:</p>
  
  <p>{
      "Version": "2012-10-17",
      "Id": "http referer policy example",
      "Statement": [
          {
              "Sid": "Allow get requests originating from www.example.com and example.com.",
              "Effect": "Allow",
              "Principal": "<em>",
              "Action": "s3:GetObject",
              "Resource": "<a href="http://test-proxy-bucket-01.s3-website.us-east-2.amazonaws.com/" rel="noreferrer">http://test-proxy-bucket-01.s3-website.us-east-2.amazonaws.com/</a></em>",
              "Condition": {
                  "StringLike": {
                      "aws:Referer": [
                          "<a href="https://xxxxxxx.execute-api.us-east-2.amazonaws.com/prod/" rel="noreferrer">https://xxxxxxx.execute-api.us-east-2.amazonaws.com/prod/</a><em>",
                          "<a href="http://xxxxxxxx.execute-api.us-east-2.amazonaws.com/prod" rel="noreferrer">http://xxxxxxxx.execute-api.us-east-2.amazonaws.com/prod</a></em>"
                      ]
                  }
              }
          }
      ]
  }</p></li>
  </ol>