Restrict S3 Bucket Access by Referer (domain) - Static Website Hosting - Cloudfront - amazon-web-services

Question

I have a website hosted on S3 and Cloudfront as distribution.
I would like the bucket to be only accessed by selected domains. I followed multiple AWS documentation files that point that I should forward Referer header, but I can't get it working since I always get 403 error.
The bucket is configured to be public:
FrontendBucket:
Type: AWS::S3::Bucket
Properties:
BucketName: ${self:custom.frontendBucketName}
AccessControl: PublicRead
WebsiteConfiguration:
IndexDocument: index.html
ErrorDocument: 404.html
RoutingRules: ${file(./redirects.json)}
CorsConfiguration:
CorsRules:
- AllowedHeaders: ["*"]
AllowedMethods: ["GET"]
AllowedOrigins: ["*"]
Id: "OpenCors"
MaxAge: "3600"
Then, in order to forward the Referer header, I have created Cloudfront Cache Policy and Cloudfront Origin Request Policy:
CloudfrontCachePolicy:
Type: AWS::CloudFront::CachePolicy
Properties:
CachePolicyConfig:
Name: cache-policy
Comment: Cache Optimized Policy (forward referer and query string)
DefaultTTL: 86400
MaxTTL: 31536000
MinTTL: 1
ParametersInCacheKeyAndForwardedToOrigin:
EnableAcceptEncodingBrotli: true
EnableAcceptEncodingGzip: true
CookiesConfig:
CookieBehavior: none
HeadersConfig:
HeaderBehavior: whitelist
Headers:
- Referer
QueryStringsConfig:
QueryStringBehavior: all
CloudfronOriginRequestPolicy:
Type: AWS::CloudFront::OriginRequestPolicy
Properties:
OriginRequestPolicyConfig:
Name: origin-request-policy
Comment: Origin Request Policy (forward referer query string)
CookiesConfig:
CookieBehavior: none
HeadersConfig:
HeaderBehavior: whitelist
Headers:
- Referer
QueryStringsConfig:
QueryStringBehavior: all
Then this is my Cloudfront distribution:
CloudfrontDistribution:
Type: AWS::CloudFront::Distribution
DependsOn: [FrontendBucket]
Properties:
DistributionConfig:
Enabled: true
Comment: "(${self:provider.stage}-${opt:lang})"
Aliases: ${self:custom.domainCondition.${self:provider.stage}.${opt:lang}, self:custom.domainCondition.other}
ViewerCertificate:
AcmCertificateArn: "${self:custom.certificateCondition.${self:provider.stage}.${opt:lang}, self:custom.certificateCondition.other.${opt:lang}}"
MinimumProtocolVersion: TLSv1.2_2018
SslSupportMethod: sni-only
Origins:
- Id:
Ref: FrontendBucket
DomainName: "${self:custom.frontendBucketName}.s3-website-${self:provider.region}.amazonaws.com"
CustomOriginConfig:
OriginProtocolPolicy: http-only
HTTPPort: 80
HTTPSPort: 443
DefaultCacheBehavior:
TargetOriginId:
Ref: FrontendBucket
ViewerProtocolPolicy: redirect-to-https
Compress: true
CachePolicyId:
Ref: CloudfrontCachePolicy
OriginRequestPolicyId:
Ref: CloudfronOriginRequestPolicy
AllowedMethods:
- GET
- HEAD
- OPTIONS
CachedMethods:
- GET
- HEAD
LambdaFunctionAssociations:
- EventType: "origin-request"
LambdaFunctionARN: ${cf.us-east-1:my-website-cle-${self:provider.stage}.RequestCLELambdaFunctionQualifiedArn}
- EventType: "origin-response"
LambdaFunctionARN: ${cf.us-east-1:my-website-cle-${self:provider.stage}.ResponseCLELambdaFunctionQualifiedArn}
As you can see, there is Origin Request Lambda#Edge assigned. I am trying to log event.Records[0].cf.request.headers there, but I can't find the referer header.
And finally this the Bucket Policy:
OnlyDomainAccessPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket:
Ref: FrontendBucket
PolicyDocument:
Statement:
- Sid: "Allow access to the bucket only from MiracleMill website"
Effect: Deny
Action: ["s3:GetObject", "s3:GetObjectVersion"]
Resource: "arn:aws:s3:::${self:custom.frontendBucketName}/*"
Principal: "*"
Condition:
StringNotLike:
aws:Referer:
[
"http://www.example.com/*",
"https://example.com/*",
]
//at this point this should work since the bucket is public but I have also added specific Allow
- Sid: "Allow access to the bucket only from MiracleMill website"
Effect: Allow
Action: ["s3:GetObject", "s3:GetObjectVersion"]
Resource: "arn:aws:s3:::${self:custom.frontendBucketName}/*"
Principal: "*"
Condition:
StringLike:
aws:Referer:
[
"http://www.www.example.com/*",
"https://www.example.com/*",
]