title: AWS S3 Bucket Policy Allow Access From Certain URL’s
body: <p>I have a power bi app that stores pdfs in an s3 bucket.  I wish to only allow access to the documents when requested from the power bi web app or the web app embeded in a web page I administer (beyondmapping.com).  I have used the policy generator to create the following bucket policy.</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Id": "Policy1513783148229",
      "Statement": [
          {
              "Sid": "Stmt1513783134644",
              "Effect": "Allow",
              "Principal": "*",
              "Action": "s3:*",
              "Resource": "arn:aws:s3:::flsarchives/*",
              "Condition": {
                  "StringLike": {
                      "aws:Referer": [
                          "https://app.powerbi.com/*",
                          "https://www.app.powerbi.com/*",
                          "http://beyondmapping.com/*",
                          "http://www.beyondmapping.com/*"
                      ]
                  }
              }
          }
      ]
  }
  </code></pre>
  
  <p>The policy validates and AWS warns me 'This bucket has public access', but when I try to access via <a href="https://app.powerbi.com/" rel="nofollow noreferrer">https://app.powerbi.com/</a> I get...</p>
  
  <pre><code>&lt;Error&gt;
  &lt;Code&gt;AccessDenied&lt;/Code&gt;
  &lt;Message&gt;Access Denied&lt;/Message&gt;
  &lt;RequestId&gt;3FC57FCB880F8210&lt;/RequestId&gt;
  &lt;HostId&gt;
  5MSm6vqLs12IgCNdVXj9p+GTg/aMxQ2U/FJ1PBPWX9vypn+OIPmzpBOpSZx1y3KkGhIz9MoTraQ=
  &lt;/HostId&gt;
  &lt;/Error&gt;
  </code></pre>
  
  <p>What should I do differently or additionally to retrieve documents from these urls?</p>
  
  <p>Edit: Current CORS.  Not sure if this is related and not sure what it should look like.</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"&gt;
  &lt;CORSRule&gt;
      &lt;AllowedOrigin&gt;*&lt;/AllowedOrigin&gt;
      &lt;AllowedMethod&gt;GET&lt;/AllowedMethod&gt;
      &lt;MaxAgeSeconds&gt;3000&lt;/MaxAgeSeconds&gt;
  &lt;/CORSRule&gt;
  &lt;CORSRule&gt;
      &lt;AllowedOrigin&gt;https://www.appdomain.com&lt;/AllowedOrigin&gt;
      &lt;AllowedMethod&gt;PUT&lt;/AllowedMethod&gt;
      &lt;AllowedMethod&gt;POST&lt;/AllowedMethod&gt;
      &lt;AllowedMethod&gt;DELETE&lt;/AllowedMethod&gt;
      &lt;AllowedHeader&gt;*&lt;/AllowedHeader&gt;
  &lt;/CORSRule&gt;
  &lt;/CORSConfiguration&gt;
  </code></pre>