如何使twilio从私有S3存储桶访问内容

Question

我将TwiML文件存储在专用的S3存储桶中，我希望Voice Call API通过Webhook访问，即

GET https://s3.amazonaws.com/mybucket/test.xml

Twilio调试器由于其私有存储区而显示403

11200 HTTP retrieval failure

他们的documentation说IP发生了变化，所以我不能只是将一堆IPS列入白名单 我可以应用某种类型的存储桶策略来允许来自Twilio服务的呼叫吗？

    {
        "Sid": "Allow get requests originating from twilio",
        "Effect": "Allow",
        "Principal": "*",
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::mybucket/*",
        "Condition": {
            "StringLike": {
                "aws:Referer": "WHAT GOES HERE??????"
            }
        }
    }