How to prevent hotlinking in AWS S3

Simple way to prevent hotlinking via referer fields in the HTTP Request.
(Does not block crafted requests)

  1. Go to AWS S3 Console
  2. Go to your bucket name -> Permissions -> Bucket Policy
  3. Enter the following policy (with replacement at the correct places)
    {
    "Version": "2008-10-17",
    "Id": "",
    "Statement": [
        {
            "Sid": "Allow in my domains",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::imsj-wordpress/*",
            "Condition": {
                "StringLike": {
                    "aws:Referer": "https://imsj.dev/*"
                }
            }
        },
        {
            "Sid": "Deny access if referer is not my sites",
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::imsj-wordpress/*",
            "Condition": {
                "StringNotLike": {
                    "aws:Referer": "https://imsj.dev/*"
                }
            }
        }
    ]
    }

5 thoughts on “How to prevent hotlinking in AWS S3

  1. I’m often to blogging and i really appreciate your content. The article has actually peaks my interest. I’m going to bookmark your web site and maintain checking for brand spanking new information.

Leave a Reply

Your email address will not be published. Required fields are marked *