0

I've got an odd situation happening with assets stored on AWS S3, which I'd appreciate some help understanding and resolving.

Background

Software Version: Craft CMS v2.9.1

All S3 assets were recently moved to a new AWS account. I can't say if this issue started occurring after that, or if it was pre-existing. I inherited management of the site, and have no prior knowledge of the accessibility of these S3 assets.

The assets have identical permissions on S3, which is via a policy on the Bucket.

The Bucket policy is:

{
    "Id": "Policy1599693986936",
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1599693977359",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListBucket",
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:GetObjectAcl",
                "s3:PutObjectAcl"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::media2.ourdomain.co.nz",
                "arn:aws:s3:::media2.ourdomain.co.nz/*"
            ],
            "Condition": {
                "StringLike": {
                    "aws:Referer": [
                        "https://ourdomain.co.nz/*",
                        "http://ourdomain.co.nz/*",
                    ]
                }
            },
            "Principal": "*"
        }
    ]
}

The Issue

Most of the assets cause a permissions error when accessed from the front-end of the site. E.g, <Error> <Code>AccessDenied</Code> <Message>Access Denied</Message> <RequestId>67D10441C68705B6</RequestId> <HostId>AJcRfJh6jciXYC61tb+UUCgPGjtq41aMhDSlVI8kFj/g9COlnW49XhBjIFAOdUtq0DJQoKd+9Iw=</HostId> </Error>

I can, however, access the same file from the back-end of the site (in Assets).

Some files I can access from the front-end. Which is odd, as to the best of my knowledge they all have the same permissions (bucket policies, etc.).

It's not clear to me how files in the same bucket, with the same permissions, can vary in their accessibility. Some I can view on front-end, some I can't (due to Access Denied error).

Can someone suggest what might be causing this, or how to resolve it?

Thank you.

UPDATE

I've discovered it's the Conditional in the policy that's breaking things. If I remove the condition (which is the referrer URL) all files I've tested on front end are now accessible (including those I couldn't access previously). This raises two question:

  1. Why would it be inconsistent when the referrer condition is there? All files are being linked to from the same referrer.
  2. Why would the referrer condition break it at all (when the links are from that referrer)?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.