How to Use Resources, Principals, Operations, and Conditions in Bucket Policies

s3:CreateBucket

s3:x-amz-acl

The Amazon S3 canned ACL that is applied to the bucket. A canned ACL represents a predefined permission that can be applied to the bucket being created.

Valid values: private | public-read | public-read-write | authenticated-read | bucket-owner-read | bucket-owner-full-control | log-delivery-write.

Example value: public-read

s3:LocationConstraint

Specifies the Region where the bucket will be created.

Valid values are us-west-1 (for Northern California) or EU (for Ireland). Do not specify a value for US Standard.

Example value: us-west-1

s3:x-amz-grant-read, s3:x-amz-grant-write,​ s3:x-amz-grant-read-acp,​ s3:x-amz-grant-write​-acp,​ ​s3:x-amz-grant-full​-control

These conditions relate to the ACL-specific request headers the action supports. You can add a condition in your bucket policy to deny or grant the action based on the presence of these headers headers with specific values. For more information about the API and the request headers, go to PUT Bucket.

For an example policy that uses these condition keys, see Granting Cross-Account Permissions to Upload Objects While Ensuring the Bucket Owner Has Full Control .

s3:ListBucket

s3:prefix

Limits the response to objects that begin with the specified prefix. Use this to allow or deny access to objects that begin with the prefix.

Example value: home

s3:delimiter

The character you use to group objects.

Example value: /

s3:max-keys

The number of objects to return from the call. The maximum allowed value (and default) is 1000.

For use with access policy language numeric conditions (for more information, see Numeric Conditions).

Example value: 100

s3:ListBucketVersions

s3:prefix

Header that lets you limit the response to include only keys that begin with the specified prefix.

Example value: home

s3:delimiter

The character you use to group objects.

Example value: /

s3:max-keys

The number of objects to return from the call. The maximum allowed value (and default) is 1000.

For use with access policy language numeric conditions (for more information, see Numeric Conditions).

Example value: 100

s3:PutBucketAcl

s3:x-amz-acl

The Amazon S3 canned ACL that is applied to the bucket. A canned ACL represents a predefined permission that can be applied to the bucket being created.

Valid values: private | public-read | public-read-write | authenticated-read | bucket-owner-read | bucket-owner-full-control | log-delivery-write.

Example value: public-read

s3:x-amz-grant-read, s3:x-amz-grant-write,​ s3:x-amz-grant-read-acp,​ s3:x-amz-grant-write​-acp,​ ​s3:x-amz-grant-full​-control

These conditions relate to the ACL-specific request headers the action supports. You can add a condition in your bucket policy to deny or grant the action based on the presence of these headers headers with specific values. For more information about the API and the request headers, go to PUT Bucket acl.

For an example policy that uses these condition keys, see Granting Cross-Account Permissions to Upload Objects While Ensuring the Bucket Owner Has Full Control .

s3:PutObject

s3:x-amz-acl

The Amazon S3 canned ACL that is applied to the object. A canned ACL represents a predefined permission that can be applied to the object being PUT to Amazon S3.

Valid values: private | public-read | public-read-write | authenticated-read | bucket-owner-read | bucket-owner-full-control | log-delivery-write.

Example value: public-read

s3:x-amz-copy-source

The header that specifies the name of the source bucket and key name of the source object, separated by a slash (/). Used when copying an object.

Example value: /bucketname/keyname

s3:x-amz-grant-read, s3:x-amz-grant-write,​ s3:x-amz-grant-read-acp,​ s3:x-amz-grant-write​-acp,​ ​s3:x-amz-grant-full​-control

These conditions relate to the ACL-specific request headers the action supports. You can add a condition in your bucket policy to deny or grant the action based on the presence of these headers headers with specific values. For more information about the API and the request headers, go to PUT Object.

For an example policy that uses these condition keys, see Granting Cross-Account Permissions to Upload Objects While Ensuring the Bucket Owner Has Full Control .

s3:x-amz-server-side-encryption

Allow the specific action only if x-amz-server-side-encryption header is present in the request and its value matches the specified condition. with

Valid values: AES256

Example value: AES256

s3:x-amz-metadata-directive

The header that specifies whether the metadata is copied from the source object or replaced with metadata provided in the request. If copied, the metadata, except for the version ID, remains unchanged. Otherwise, all original metadata is replaced by the metadata you specify. Used when copying an object.

Valid values: COPY | REPLACE. The default is COPY.

Example value: REPLACE

s3:PutObjectAcl

s3:x-amz-acl

The Amazon S3 canned ACL that is applied to the object. A canned ACL represents a predefined permission that can be applied to the object being PUT to Amazon S3.

Valid values: private | public-read | public-read-write | authenticated-read | bucket-owner-read | bucket-owner-full-control | log-delivery-write.

Example value: public-read

s3:x-amz-grant-read, s3:x-amz-grant-write,​ s3:x-amz-grant-read-acp,​ s3:x-amz-grant-write​-acp,​ ​s3:x-amz-grant-full​-control

These conditions relate to the ACL-specific request headers the action supports. You can add a condition in your bucket policy to deny or grant the action based on the presence of these headers headers with specific values. For more information about the API and the request headers, go to PUT Object acl.

For an example policy that uses these condition keys, see Granting Cross-Account Permissions to Upload Objects While Ensuring the Bucket Owner Has Full Control .

s3:GetObjectVersion

s3:VersionId

The version ID of the object being retrieved.

Example value: Upfdndhfd8438MNFDN93jdnJFkdmqnh893

s3:GetObjectVersionAcl

s3:VersionId

The version ID of the object ACL being retrieved.

Example value: Upfdndhfd8438MNFDN93jdnJFkdmqnh893

s3:PutObjectVersionAcl

s3:VersionId

The version ID of the object ACL being PUT.

Example value: Upfdndhfd8438MNFDN93jdnJFkdmqnh893

s3:x-amz-acl

The Amazon S3 canned ACL that is applied to the object. A canned ACL represents a predefined permission that can be applied to the object being PUT to Amazon S3.

Valid values: private | public-read | public-read-write | authenticated-read | bucket-owner-read | bucket-owner-full-control | log-delivery-write.

Example value: public-read

s3:x-amz-grant-read, s3:x-amz-grant-write,​ s3:x-amz-grant-read-acp,​ s3:x-amz-grant-write​-acp,​ ​s3:x-amz-grant-full​-control

These conditions relate to the ACL-specific request headers the action supports. You can add a condition in your bucket policy to deny or grant the action based on the presence of these headers headers with specific values. For more information about the API and the request headers, go to PUT Object acl.

For an example policy that uses these condition keys, see Granting Cross-Account Permissions to Upload Objects While Ensuring the Bucket Owner Has Full Control .

s3:DeleteObjectVersion

s3:VersionId

The version ID of the object being deleted.

Example value: Upfdndhfd8438MNFDN93jdnJFkdmqnh893