AWS S3 Bucket Policy: Hotlink Protection by use Referer

{
    "Id": "Referer-Hot-Link-Protection",
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "CXPLAY-ORG",
        "Action": [
          "s3:GetObject",
          "s3:HeadObject"
        ],
        "Effect": "Allow",
        "Resource": "*",
        "Condition": {
          "StringLike": {
            "aws:Referer": "*.cxplay.org"
          },
          "StringEquals": {
            "aws:Referer": "cxplay.org"
          }
        }
      },
      {
        "Sid": "CX-MS",
        "Action": [
          "s3:GetObject",
          "s3:HeadObject"
        ],
        "Effect": "Allow",
        "Resource": "*",
        "Condition": {
          "StringLike": {
            "aws:Referer": "*.cx.ms"
          },
          "StringEquals": {
            "aws:Referer": "cx.ms"
          }
        }
      },
      {
        "Sid": "REFERER-BLANK",
        "Action": [
          "s3:GetObject",
          "s3:HeadObject"
        ],
        "Effect": "Allow",
        "Resource": "*",
        "Condition": {
          "Null": {
            "aws:Referer": "true"
          }
        }
      }
    ]
  }

1. AWS Policy Generator

2. AWS global condition context keys - AWS Identity and Access Management

3. IAM JSON policy elements: Condition operators - AWS Identity and Access Management

4. AWS JSON policy elements: Principal - AWS Identity and Access Management