title: copyObject Access Denied on S3 Bucket despite policy allowing my site referrer
body: <p>I am using AWS SDK for PHP to upload and display files to/from my S3 bucket.</p>
  
  <p>The files should only be accessible through my site, no other referrer allowed - no hotlinking etc.</p>
  
  <p>I also need to be able to copy objects within the bucket.</p>
  
  <p>I create and connect as normal:</p>
  
  <pre><code>    $s3Client = new Aws\S3\S3Client([
          'version'       =&gt; 'latest',
          'region'        =&gt; 'eu-west-2'
      ]);
  
      $s3 = $s3Client::factory(array(
          'version'       =&gt; 'latest',
          'region'        =&gt; 'eu-west-2',
          'credentials'   =&gt; array(
          'provider'      =&gt; $provider,
          'key'           =&gt; $key,
          'secret'        =&gt; $secret
          )
      ));
  </code></pre>
  
  <p>And execute Copy object command:</p>
  
  <pre><code>    $s3-&gt;copyObject([
          'Bucket'     =&gt; "{$targetBucket}",
          'Key'        =&gt; "{$targetKeyname}",
          'CopySource' =&gt; "{$sourceBucket}/{$sourceKeyname}",
      ]);
  </code></pre>
  
  <p>I have tried a policy using "Allow if string like referrer" but AWS then tells me I'm allowing public access?!?!?
  Everything works just fine EVEN the copyObject action but files are still accessible directly and from everywhere!</p>
  
  <p>I try using "Deny if string not like referrer" which works mostly as expected - I can upload and display the files and the files don't show when linked directly (which is what i want) - However, the copyObject action no longer works and i get the access denied error.</p>
  
  <p>I've tried everything else i can think of and spent hours googling and searching for answers but to no avail.</p>
  
  <p>Here's each seperate policy...</p>
  
  <p>ALLOW FILE ACCESS ONLY (GetObject) if string LIKE referrer:</p>
  
  <pre><code>{
  "Version": "2008-10-17",
  "Id": "",
  "Statement": [
      {
          "Sid": "Deny access if referer is not my site",
          "Effect": "Deny",
          "Principal": {
              "AWS": "*"
          },
          "Action": "s3:GetObject",
          "Resource": [
              "arn:aws:s3:::MY-BUCKET/*"
          ],
          "Condition": {
              "StringLike": {
                  "aws:Referer": [
                      "http://MY-SITE/*",
                      "https://MY-SITE/*"
                      ]
                  }
              }
          }
      ]
  }
  </code></pre>
  
  <p>RESULT: uploads &amp; copyObject work but files are still accessible everywhere</p>
  
  <hr>
  
  <p>DENY ALL ACTIONS (*) if string NOT LIKE referrer:</p>
  
  <pre><code>{
  "Version": "2008-10-17",
  "Id": "",
  "Statement": [
      {
          "Sid": "Deny access if referer is not my site",
          "Effect": "Deny",
          "Principal": {
              "AWS": "*"
          },
          "Action": "s3:GetObject",
          "Resource": [
              "arn:aws:s3:::MY-BUCKET/*"
          ],
          "Condition": {
              "StringNotLike": {
                  "aws:Referer": [
                      "http://MY-SITE/*",
                      "https://MY-SITE/*"
                      ]
                  }
              }
          }
      ]
  }
  </code></pre>
  
  <p>RESULT: copyObject action no longer works and i get the access denied error</p>