Policies and Permissions in Amazon S3 - Amazon Simple Storage Service

Policies and Permissions in Amazon S3

This page provides an overview of bucket and user policies in Amazon S3 and describes the basic elements of a policy. Each listed element links to more details about that element and examples of how to use it.

For a complete list of Amazon S3 actions, resources, and conditions, see Actions, resources, and condition keys for Amazon S3 in the Service Authorization Reference.

In its most basic sense, a policy contains the following elements:

  • Resource – The Amazon S3 bucket, object, access point, or job that the policy applies to. Use the Amazon Resource Name (ARN) of the bucket, object, access point, or job to identify the resource.

    An example for bucket-level operations:

    - "Resource": "arn:aws:s3:::bucket_name".

    Examples for object-level operations:

    - "Resource": "arn:aws:s3:::bucket_name/*" for all objects in the bucket.

    - "Resource": "arn:aws:s3:::bucket_name/prefix/*" for objects under a certain prefix in the bucket.

    For more information, see Amazon S3 resources.

  • Actions – For each resource, Amazon S3 supports a set of operations. You identify resource operations that you will allow (or deny) by using action keywords.

    For example, the s3:ListBucket permission allows the user to use the Amazon S3 GET Bucket (List Objects) operation. For more information about using Amazon S3 actions, see Amazon S3 policy actions. For a complete list of Amazon S3 actions, see Actions.

  • Effect – What the effect will be when the user requests the specific action—this can be either allow or deny.

    If you do not explicitly grant access to (allow) a resource, access is implicitly denied. You can also explicitly deny access to a resource. You might do this to make sure that a user can't access the resource, even if a different policy grants access. For more information, see IAM JSON Policy Elements: Effect.

  • Principal – The account or user who is allowed access to the actions and resources in the statement. In a bucket policy, the principal is the user, account, service, or other entity that is the recipient of this permission. For more information, see Principals.

  • Condition – Conditions for when a policy is in effect. You can use AWS‐wide keys and Amazon S3‐specific keys to specify conditions in an Amazon S3 access policy. For more information, see Amazon S3 condition key examples.

The following example bucket policy shows the effect, principal, action, and resource elements. The policy allows Akua, a user in account Account-ID, s3:GetObject, s3:GetBucketLocation, and s3:ListBucket Amazon S3 permissions on the awsexamplebucket1 bucket.

{
    "Version": "2012-10-17",
    "Id": "ExamplePolicy01",
    "Statement": [
        {
            "Sid": "ExampleStatement01",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:user/Akua"
            },
            "Action": [
                "s3:GetObject",
                "s3:GetBucketLocation",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::awsexamplebucket1/*",
                "arn:aws:s3:::awsexamplebucket1"
            ]
        }
    ]
}

For more, see the topics below. For complete policy language information, see Policies and Permissions and IAM JSON Policy Reference in the IAM User Guide.

Topics