Here is an example bucket policy below for Amazon S3 that will limit it to a Specific Referer and URL only, so that your content can not be linked to from other websites.
{ "Version": "2012-10-17", "Id": "HttpsRefererPolicyForMySite", "Statement": [ { "Sid": "AllowGetRequestsReferredUrlSpecificForMySite", "Effect": "Allow", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-bucket-name/*", "Condition": { "StringLike": { "aws:Referer": [ "https://mysite.com/this-specific-page-only", "https://mysite.com/only-child-pages-of-this-page/*", "https://mysite.com/this-specific-page-and-child-pages*" ] } } }, { "Sid": "ExplicitDenyIfNotUrlSpecificForMySite", "Effect": "Deny", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-bucket-name/*", "Condition": { "StringNotLike": { "aws:Referer": [ "https://mysite.com/this-specific-page-only", "https://mysite.com/only-child-pages-of-this-page/*", "https://mysite.com/this-specific-page-and-all-child-pages*" ] } } } ] }
As a couple points of interest, note that for one specific URL to work, you should NOT put /* on the end of it. To specify a specific URL, you use it like this:
https://mysite.com/this-specific-page-only
If you specify a URL with /* on the end, then it will only work for children of that URL, not the specific URL itself. For example, if you use this:
https://mysite.com/only-child-pages-of-this-page/*
then content will NOT play on the specific URL https://mysite.com/only-child-pages-of-this-page but WILL only play on https://mysite.com/only-child-pages-of-this-page/any-other-page
So if you want content to be available on your whole site (including the main domain), you will need to include BOTH the following:
https://mysite.com
https://mysite.com/*
However this sitll will not work for a url with extra GET data, such as:
https://mysite.com?data=123
So to include this you need add the * to the end without the slash, and this will inlcude the specific page as well as all child pages:
https://mysite.com*