How to revoke public permissions from a Amazon S3 Bucket

Question

I created a Amazon S3 Bucket to store only images from my website. I have more than 1 million images all with public read access. Everytime I make a login, Amazon gives me this warning:

"This bucket has public access You have provided public access to this bucket. We highly recommend that you never grant any kind of public access to your S3 bucket. "

I'm using the following Bucket Policy to only allow images to be shown just in my site:

{
    "Version": "2012-10-17",
    "Id": "http referer policy example",
    "Statement": [
        {
            "Sid": "Allow get requests originated from www.example.com and example.com.br",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::examplebucket.com/*",
            "Condition": {
                "StringLike": {
                    "aws:Referer": [
                        "http://www.example.com/*",
                        "http://www.example.com.br/*",
                        "https://www.example.com/*",
                        "https://www.example.com.br/*"
                    ]
                }
            }
        }
    ]
}

How can I revoke the public access to the bucket and to my files and grant it only to my sites?

Thank you!

Answer 1

It's a scary warning meant to prevent people from leaking data unintentionally. There have been lots of cases in the news lately about companies accidentally setting permissions to allow public reads.

In your case you really do want these to be publicly readable so you can just ignore the warning. Your security policy looks fine and still matches the documentation for public hosting.

You could theoretically put these images behind another server that streams them to the user if you really don't want someone to be able to download them directly. That's not really any more secure though.

If you do not want to have these publicly available at all just delete this policy from your bucket. In that case your website will not be able to serve the images.

Answer 2

Your policy looks good. You are providing a higher level of security then just public thru the referer header and not allowing the listing of objects.

Using S3 to provide common files such as CSS, JS and Images is just so easy. However, with all of the accidental security problems I usually recommend one of these approaches:

1. Turn on static web site hosting for the bucket. This makes it very clear to future admins that this bucket is intended for public files. Also I do not see big warning messages for these buckets. Enable redirect requests.
2. Better, turn off all public access and use CloudFront. Enable Origin Access Identity. You receive all the benefits of CloudFront, tighter security, etc.

Using an Origin Access Identity to Restrict Access to Your Amazon S3 Content