Support for bucket policies is in the works. In fact, for many basic use cases it is available via the API today. Though at this time, support is not available in the UI nor is it officially documented. There may be inconsistencies between regions and certain features may not work as expected just yet. Consider it an alpha release for all intents and purposes. If that hasn’t scared you off just yet, here is an example that I’ve tested and confirmed to work in NYC3.
Using the AWS cli, you can post a bucket policy with:
aws s3api --endpoint-url=https://nyc3.digitaloceanspaces.com \
put-bucket-policy \
--bucket examplebucket \
--policy file://policy.json
Where the contents of policy.json look like:
{
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::examplebucket/*",
"Condition": {
"StringLike": {
"aws:Referer": [
"http://example.com/*"
]
}
}
},
{
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::examplebucket/*",
"Condition": {
"StringNotLike": {
"aws:Referer": [
"http://example.com/*"
]
}
}
}
]
}
This specifies that objects in the bucket are accessible when the referer is example.com. Any other referer will return a 403 (Forbidden) instead.
It’s important to note that this does not prevent someone from accessing the object directly or downloading it, just embedding it into their site.
