This might be a really simple issue for someone who has experience with hosting files on Amazon S3, for download by their members / subscribers. I'm just finding my feet with S3 and what I thought looked relatively straightforward, is causing me a few headaches.
I have my bucket, with a few folders and a test zip file for download in one of the folders. I am setting up a membership site and I only want signed in members to be able to download the files.
I set up a bucket policy (which I built using the Amazon S3 tool) - as an http referrer policy - with the idea being that requests for download coming from within my site would be authenticated. So the statement goes like this ...
"Sid":"Allow get requests referred by www.mydomain.com and mydomain.com". Obviously mydomain.com is replaced with my real domain name and there is more to the complete bucket policy.I have applied the bucket policy to the bucket and all subfolders and objects.
I have also checked the Read box for Authenticated Users for the Bucket, the folder and the object, in the ACL Settings.
When I put a download link in my members area, I get an 'Access Denied' message.
However, I can download my test file if I also check the Read box for 'All Users', but then I can also download it from a page on another domain too, and I don't want completely public access.
Any ideas what I'm doing wrong? How do I restrict access to my files, to just my subscribers - where they can download the files when they are signed in to the membership area of my site? I guess many people here must have membership sites where the assets are for members only.