title: Restrict Amazon S3 to CloudFront and http referrer
body: <p>I have an Amazon S3 REST endpoint for images and file assets. I want the S3 bucket only accessible by CloudFront and the website accessing the images (using http referrer).</p>
  
  <p>This is my bucket policy so far:</p>
  
  <pre><code>{
      "Version": "2008-10-17",
      "Id": "PolicyForCloudFrontPrivateContent",
      "Statement": [
          {
              "Sid": "1",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity XXXXXXXXXXXX"
              },
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::&lt;DOMAIN&gt;/*",
              "Condition":{
                  "StringLike":{"aws:Referer":["http://&lt;DOMAIN&gt;/*"]}
              }
          }
      ]
  }
  </code></pre>
  
  <p>But once I apply the policy, the images are not accessible on the website.</p>
  
  <p>Is this possible to do? </p>