# s3-bucket-blacklisted-actions-prohibited
<a name="s3-bucket-blacklisted-actions-prohibited"></a>

Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other AWS accounts. For example, the rule checks that the Amazon S3 bucket policy does not allow another AWS account to perform any `s3:GetBucket*` actions and `s3:DeleteObject` on any object in the bucket. The rule is NON\_COMPLIANT if any blocklisted actions are allowed by the Amazon S3 bucket policy.

**Note**  
The rule will only check for entities in the Principal property and does not take into account any conditionals under the Condition property in a policy

**Note**  
If a single value in an S3 bucket policy (for example, one Resource or Condition value) contains more than five IAM [policy variables](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#policy-vars-using-variables), the rule can't evaluate that policy and returns NON\_COMPLIANT, even if the policy would otherwise be compliant. To get an accurate evaluation, split any value that contains more than five policy variables so that each value contains five or fewer.

**Identifier:** S3\_BUCKET\_BLACKLISTED\_ACTIONS\_PROHIBITED

**Resource Types:** AWS::S3::Bucket

**Trigger type:** Configuration changes

**AWS Region:** All supported AWS regions

**Parameters:**

blacklistedActionPatternType: CSV  
Comma-separated list of blacklisted action patterns, for example, s3:GetBucket\* and s3:DeleteObject.

## AWS CloudFormation template
<a name="w2aac20c16c17b7e1419c21"></a>

To create AWS Config managed rules with AWS CloudFormation templates, see [Creating AWS Config Managed Rules With AWS CloudFormation Templates](aws-config-managed-rules-cloudformation-templates.md).