title: Amazon S3 bucket policy allow access to ONLY specific http
body: <p>I'm trying to restrict access to objects (media files) in an Amazon S3 bucket to a specific referral domain, <code>privatewebsite.com</code>, with a bucket policy, but keep getting access denied, no matter the domain referred.</p>
  <p>I have the following settings for Block Public Access</p>
  <blockquote>
  <p>Block public access to buckets and objects granted through new access control lists (ACLs) - On</p>
  <p>Block public access to buckets and objects granted through any access control lists (ACLs) - On</p>
  <p>Block public access to buckets and objects granted through new public bucket policies - Off</p>
  <p>Block public and cross-account access to buckets and objects through any public bucket policies - Off</p>
  </blockquote>
  <p>I've added the following code, URL with and without, http:// and https://, yet still get access denied. (privatewebsite.com, <a href="https://privatewebsite.com" rel="noreferrer">https://privatewebsite.com</a>, <a href="http://privatewebsite.com" rel="noreferrer">http://privatewebsite.com</a>)</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Id&quot;: &quot;Policy8675309&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;Stmt8675309&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: &quot;*&quot;,
              &quot;Action&quot;: &quot;s3:GetObject&quot;,
              &quot;Resource&quot;: &quot;arn:aws:s3:::my-media-bucket/*&quot;,
              &quot;Condition&quot;: {
                  &quot;StringLike&quot;: {
                      &quot;aws:Referer&quot;: &quot;https://privatewebsite.com&quot;
                  }
              }
          },
          {
              &quot;Sid&quot;: &quot;Explicit deny to ensure requests are allowed only from specific referer.&quot;,
              &quot;Effect&quot;: &quot;Deny&quot;,
              &quot;Principal&quot;: &quot;*&quot;,
              &quot;Action&quot;: &quot;s3:*&quot;,
              &quot;Resource&quot;: &quot;arn:aws:s3:::my-media-bucket/*&quot;,
              &quot;Condition&quot;: {
                  &quot;StringNotLike&quot;: {
                      &quot;aws:Referer&quot;: [
                          &quot;https://privatewebsite.com/*&quot;,
                          &quot;http://privatewebsite.com/*&quot;
                      ]
                  }
              }
          }
      ]
  }
  </code></pre>
  <p>Can anyone see any obvious errors in my bucket policy?</p>
  <p>I expect this policy to ALLOW any request, when coming from a page on privatewebsite.com, while DENY-ing all other requests, but at the moment ALL requests are denied.</p>