title: S3 bucket policy to set a folder readable by a referring URL, and another folder only available to AWS user
body: <p>We have a structure with a Laravel app running in URL www.example.com and connected to a bucket with 3 folders inside.</p>
  
  <pre><code>folder_a
  folder_b
  folder_c
  </code></pre>
  
  <p>Ideally, we would like the app to be able to:</p>
  
  <ul>
  <li>Upload objects to the three folders</li>
  <li>Get objects from folder_a (but only on requests that come from www.example.com/example.com and not everywhere on internet (avoiding hotlinking and direct URL access)</li>
  </ul>
  
  <p>Also, <code>folder_b</code> and <code>folder_c</code> should be absolutely forbidden from internet (not listing folder, nor getting an object even knowing the URL)
  At the same time, the IAM user should be able to access everything, upload/download/edit/delete everything.</p>
  
  <p>We have tried lots of bucket policies without success. We have successfully created the IAM user, and our Laravel app is already sending objects to the S3.</p>
  
  <blockquote> NOTE: This is not about Laravel configuration, it's about S3 bucket policies. The app is already sending objects to S3 correctly, and all objects are public now</blockquote>