amazon-web-servicesgoogle-plus

Aws S3 bucket policy for google plus user agent


After surfing the internet I finally know that google+ use this user agent " Google (+https://developers.google.com/+/web/snippet/) " but when I whitelisted this user agent on my S3 bucket policy, it somehow didn't work. This is S3 policy for useragent. Any help would be appreciated.

{
"Version": "2008-10-17",
"Statement": [
    {
        "Sid": "Allow in my domains",
        "Effect": "Allow",
        "Principal": {
            "AWS": "*"
        },
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::awesomebucket/*",
        "Condition": {
            "StringEquals": {
                "aws:UserAgent": [
                    "Twitterbot/",
                    "Google (+https://developers.google.com/+/web/snippet/)",
                    "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)"
                ]
            }
        }
    },
    {
        "Sid": "Deny access if referer is not my sites",
        "Effect": "Deny",
        "Principal": {
            "AWS": "*"
        },
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::awesomebucket/*",
        "Condition": {
            "StringNotEquals": {
                "aws:UserAgent": [
                    "Twitterbot/",
                    "Google (+https://developers.google.com/+/web/snippet/)",
                    "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)"
                ]
            }
        }
    }
]}

Solution

  • Your web server will see a request with the user agent containing the following text

    The AWS string conditions you are using are exact matchers but the Google+ UA just contains that string. The actual UA will look something like this:

    Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.75 Safari/537.36 Google (+https://developers.google.com/+/web/snippet/)
    

    You'll want to use the StringLike condition or something similar.