title: AWS S3: Unable to restrict access to bucket resources only on my website
body: <p>According to the <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html#example-bucket-policies-use-case-4" rel="nofollow noreferrer">documentation</a>, all I have to do is add this S3 bucket policy:</p>
  <pre><code>{
    &quot;Version&quot;:&quot;2012-10-17&quot;,
    &quot;Id&quot;:&quot;http referer policy example&quot;,
    &quot;Statement&quot;:[
      {
        &quot;Sid&quot;:&quot;Allow get requests originating from www.example.com and example.com.&quot;,
        &quot;Effect&quot;:&quot;Allow&quot;,
        &quot;Principal&quot;:&quot;*&quot;,
        &quot;Action&quot;:[&quot;s3:GetObject&quot;,&quot;s3:GetObjectVersion&quot;],
        &quot;Resource&quot;:&quot;arn:aws:s3:::DOC-EXAMPLE-BUCKET/*&quot;,
        &quot;Condition&quot;:{
          &quot;StringLike&quot;:{&quot;aws:Referer&quot;:[&quot;http://www.example.com/*&quot;,&quot;http://example.com/*&quot;]}
        }
      }
    ]
  }
  </code></pre>
  <p>So I went to my bucket and I found these existing policies:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2008-10-17&quot;,
      &quot;Id&quot;: &quot;Policy1335892530063&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;Stmt1335892150622&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;Service&quot;: &quot;billingreports.amazonaws.com&quot;
              },
              &quot;Action&quot;: [
                  &quot;s3:GetBucketAcl&quot;,
                  &quot;s3:GetBucketPolicy&quot;
              ],
              &quot;Resource&quot;: &quot;arn:aws:s3:::bucket-name&quot;,
              &quot;Condition&quot;: {
                  &quot;StringEquals&quot;: {
                      &quot;aws:SourceArn&quot;: &quot;arn:aws:cur:us-east-1:122xxxxxx328:definition/*&quot;,
                      &quot;aws:SourceAccount&quot;: &quot;122xxxxx328&quot;
                  }
              }
          },
          {
              &quot;Sid&quot;: &quot;Stmt1335892526596&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;Service&quot;: &quot;billingreports.amazonaws.com&quot;
              },
              &quot;Action&quot;: &quot;s3:PutObject&quot;,
              &quot;Resource&quot;: &quot;arn:aws:s3:::bucket-name/*&quot;,
              &quot;Condition&quot;: {
                  &quot;StringEquals&quot;: {
                      &quot;aws:SourceArn&quot;: &quot;arn:aws:cur:us-east-1:122xxxxx328:definition/*&quot;,
                      &quot;aws:SourceAccount&quot;: &quot;122xxxxx5328&quot;
                  }
              }
          }
      ]
  }
  </code></pre>
  <p>So I added this one:</p>
  <pre><code>{
      &quot;Sid&quot;: &quot;Allow get requests originating from www.mywebsite.com and mywebsite.com.&quot;,
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Principal&quot;: &quot;*&quot;,
      &quot;Action&quot;: [
          &quot;s3:GetObject&quot;,
          &quot;s3:GetObjectVersion&quot;
      ],
      &quot;Resource&quot;: &quot;arn:aws:s3:::bucket-name/*&quot;,
      &quot;Condition&quot;: {
          &quot;StringLike&quot;: {
              &quot;aws:Referer&quot;: [
                  &quot;https://www.mywebsite.com/*&quot;,
                  &quot;https://mywebsite.com/*&quot;
              ]
          }
      }
  }
  </code></pre>
  <p>And so this is the final result:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2008-10-17&quot;,
      &quot;Id&quot;: &quot;Policy1335892530063&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;Stmt1335892150622&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;Service&quot;: &quot;billingreports.amazonaws.com&quot;
              },
              &quot;Action&quot;: [
                  &quot;s3:GetBucketAcl&quot;,
                  &quot;s3:GetBucketPolicy&quot;
              ],
              &quot;Resource&quot;: &quot;arn:aws:s3:::bucket-name&quot;,
              &quot;Condition&quot;: {
                  &quot;StringEquals&quot;: {
                      &quot;aws:SourceArn&quot;: &quot;arn:aws:cur:us-east-1:122xxxxxx328:definition/*&quot;,
                      &quot;aws:SourceAccount&quot;: &quot;122xxxxx328&quot;
                  }
              }
          },
          {
              &quot;Sid&quot;: &quot;Stmt1335892526596&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;Service&quot;: &quot;billingreports.amazonaws.com&quot;
              },
              &quot;Action&quot;: &quot;s3:PutObject&quot;,
              &quot;Resource&quot;: &quot;arn:aws:s3:::bucket-name/*&quot;,
              &quot;Condition&quot;: {
                  &quot;StringEquals&quot;: {
                      &quot;aws:SourceArn&quot;: &quot;arn:aws:cur:us-east-1:122xxxxx328:definition/*&quot;,
                      &quot;aws:SourceAccount&quot;: &quot;122xxxxx5328&quot;
                  }
              }
          },
          {
              &quot;Sid&quot;: &quot;Allow get requests originating from www.mywebsite.com and mywebsite.com.&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: &quot;*&quot;,
              &quot;Action&quot;: [
                  &quot;s3:GetObject&quot;,
                  &quot;s3:GetObjectVersion&quot;
              ],
              &quot;Resource&quot;: &quot;arn:aws:s3:::bucket-name/*&quot;,
              &quot;Condition&quot;: {
                  &quot;StringLike&quot;: {
                      &quot;aws:Referer&quot;: [
                          &quot;https://www.mywebsite.com/*&quot;,
                          &quot;https://mywebsite.com/*&quot;
                      ]
                  }
              }
          }
      ]
  }
  </code></pre>
  <p>But, still the resources wouldn't load on mywebsite.<br />
  Any idea what's going on or what I should check to debug this?</p>