title: Restricting access to AWS S3 bucket based on referer
body: <p>I'm trying to restrict access to a S3 bucket and only allowing certain domains from a list based on the referer.</p>
  
  <p>The bucket policy is basically:</p>
  
  <pre><code>{
  "Version": "2012-10-17",
  "Id": "http referer domain lock",
  "Statement": [
      {
          "Sid": "Allow get requests originating from specific domains",
          "Effect": "Allow",
          "Principal": "*",
          "Action": "s3:GetObject",
          "Resource": "arn:aws:s3:::example.com/*",
          "Condition": {
              "StringLike": {
                  "aws:Referer":  [ 
                      "*othersite1.com/*",
                      "*othersite2.com/*",
                      "*othersite3.com/*"
                  ]
              }
          }
      }
   ]
  }
  </code></pre>
  
  <p>This othersite1,2 and 3 call an object that i have stored in my s3 bucket under the domain example.com.
  I also have a cloudfront distribution attached to the bucket. I'm using * wildcard before and after the string condition. The referer can be othersite1.com/folder/another-folder/page.html. The referer may also use http or https.</p>
  
  <p>I don't know why I'm getting 403 Forbidden error.</p>
  
  <p>I'm doing this basically because i don't want other sites to call that object.</p>
  
  <p>Any help would be greatly appreciated.</p>