Amazon S3 allow specific domain to access bucket - amazon-web-services

Question

I'm trying to allow a specific domain to access my Amazon S3 bucket but after that all the domains has been dropped from Amazon S3. The url I wish to access is https://s3.ap-southeast-2.amazonaws.com/{bucketUri}/1.jpg but returns 403 forbidden on my allowed referer. I can see the Referer on the page is correct.
Here's my settings:
Block public access all off.
Bucket policy:
{
"Version": "2008-10-17",
"Id": "Restrict based on HTTP referrer policy",
"Statement": [
{
"Sid": "1",
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Action": "*",
"Resource": "arn:aws:s3:::{bucketUri}",
"Condition": {
"StringNotLike": {
"aws:Referer": "http://reference.domain.put.here"
}
}
}
]
}

Answer 1

You should use Allow type policies as shown here, not Deny. Also your Resource is incorrect:
{
"Version":"2012-10-17",
"Id":"http referer policy example",
"Statement":[
{
"Sid":"Allow get requests originating from www.example.com and example.com.",
"Effect":"Allow",
"Principal":"*",
"Action":["s3:GetObject","s3:GetObjectVersion"],
"Resource":"arn:aws:s3:::DOC-EXAMPLE-BUCKET/*",
"Condition":{
"StringLike":{"aws:Referer":["http://reference.domain.put.here"]}
}
}
]
}
And please note that aws:Referer does not really protect you. It is a merely inconvenience to bypass, as you can easly spoof aws:Referer.

Answer 2

Do an explicit Allow, not Deny. Change the referer to StringLike instead.