Images hosted on S3 AWS are not displayed on Facebook [duplicate] - facebook

Question

I have a bucket of user images on Amazon S3 and I would like to allow access only to my Facebook Messenger bot. It seemed like the best way to do this was to create a bucket policy with a condition that only allows referrals from a Facebook url. But this doesn't work - the images fail to load in the bot.
Here is the bucket policy I created (trying both facebook.com and graph.facebook.com):
{
"Version": "2012-10-17",
"Id": "Facebook referer policy",
"Statement": [
{
"Sid": "Allow get requests originating from Facebook Messenger",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-bucket/*",
"Condition": {
"StringLike": {
"aws:Referer": [
"https://www.facebook.com/*",
"https://www.graph.facebook.com/*"
]
}
}
}
]
}
When I change the bucket policy back to public (as per below) then the images load fine so the problem must be an access one.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AddPerm",
"Effect": "Allow",
"Principal": "*",
"Action": [
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::my-bucket/*"
]
}
]
}
Anyone have any better solutions for how to do this?

Answer 1

Solved thanks to the comment above and the user agent documentation from Facebook
The working bucket policy is this:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-bucket/*",
"Condition": {
"StringLike": {
"aws:UserAgent": [
"facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)",
"facebookexternalhit/1.1",
"Facebot"
]
}
}
}
]
}