S3 Policy Deny for all principals but - amazon-web-services

Question

I am attempting to deny public users from accessing signedUrl paths directly, unless it's loaded by my website <img> tag.
Typical users should not allow to copy the image URL directly in the address bar and download the image.
The allow policy
{
"Sid": "Allow public with signedUrl",
"Effect": "Allow",
"Principal": "*",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::my-chat-attachments-development/*",
"Condition": {
"StringLike": {
"aws:Referer": [
"http://localhost:4000/*",
"http://localhost:3000/*",
"https://mydomain1/*",
"https://mydomain2/*"
]
}
}
},
Below explicitly deny public access. Without the following policy, public users can still copy and paste image URL directly in the address bar (undesirable).
{
"Sid": "Statement to deny anybody without referrer",
"Effect": "Deny",
"NotPrincipal": {
"AWS": [
"arn:aws:iam::1234:user/S3UserfullAccess",
"arn:aws:iam::1234:role/LambdaFullAccess"
]
},
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::my-chat-attachments-development/*",
"Condition": {
"StringNotLike": {
"aws:Referer": [
"http://localhost:4000/*",
"http://localhost:3000/*",
"https://mydomain1/*",
"https://mydomain2/*"
]
}
}
}
Problem
I have the above policy settings, and it works well (public users are shown a access denied page). However, it also means my lambda, and my nodejs app servers cannot access the S3 even though I added NotPrincipal in the policy.
Please advise how can I correct my policy to achieve my desire behavior.
PS: I do note the above referer hack will not stop technical users from spoofing referring addresses.