How to prevent hotlinking of files hosted in Digital Ocean Spaces?

Support for bucket policies is in the works. In fact, for many basic use cases it is available via the API today. Though at this time, support is not available in the UI nor is it officially documented. There may be inconsistencies between regions and certain features may not work as expected just yet. Consider it an alpha release for all intents and purposes. If that hasn’t scared you off just yet, here is an example that I’ve tested and confirmed to work in NYC3.

Using the AWS cli, you can post a bucket policy with:

aws s3api --endpoint-url=https://nyc3.digitaloceanspaces.com \
    put-bucket-policy \
    --bucket examplebucket \
    --policy file://policy.json

Where the contents of policy.json look like:

{
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::examplebucket/*",
            "Condition": {
                "StringLike": {
                    "aws:Referer": [
                        "http://example.com/*"
                    ]
                }
            }
        },
        {
          "Effect": "Deny",
          "Principal": {
            "AWS": "*"
          },
          "Action": "s3:GetObject",
          "Resource": "arn:aws:s3:::examplebucket/*",
          "Condition": {
            "StringNotLike": {
              "aws:Referer": [
                "http://example.com/*"
              ]
            }
          }
        }
    ]
}

This specifies that objects in the bucket are accessible when the referer is example.com. Any other referer will return a 403 (Forbidden) instead.

It’s important to note that this does not prevent someone from accessing the object directly or downloading it, just embedding it into their site.

I need to know any updates on this ? As putting CDN ahead is another cost addon for me and wish to restrict & disable hotlinking of all files put up on Digital Ocean Spaces.

Does DigitalOcean offer any official way to prevent hotlinking yet?