Amazon S3 的動作、資源和條件索引鍵

Amazon S3 (服務字首：s3) 提供以下專屬於服務的資源、動作和條件內容金鑰，供 IAM 許可政策中使用。

參考資料：

• 了解如何設定此服務。

• 檢視可供此服務使用的 API 操作清單。

• 了解如何使用 IAM 許可政策來保護此服務及其資源。

Amazon S3 定義的動作

您可在 IAM 政策陳述式的 Action 元素中指定以下動作。使用政策來授予在 AWS中執行操作的許可。在政策中使用動作時，通常會允許或拒絕存取相同名稱的 API 操作或 CLI 命令。不過，在某些情況下，單一動作可控制對多個操作的存取。或者，某些操作需要多種不同的動作。

「動作」資料表的資源類型欄會指出每個動作是否支援資源層級的許可。如果此欄沒有值，您必須在政策陳述式的 Resource 元素中指定政策適用的所有資源 ("*")。如果資料欄包含資源類型，則您可以在具有該動作的陳述式中指定該類型的 ARN。如果動作具有一或多個必要資源，呼叫者必須具有對這些資源使用動作的許可。表格中的必要資源會以星號 (*) 表示。如果您使用 IAM 政策中的 Resource 元素限制資源存取，則每種必要的資源類型必須要有 ARN 或模式。某些動作支援多種資源類型。如果資源類型是選用 (未顯示為必要)，則您可以選擇使用其中一種選用資源類型。

「動作」資料表的條件索引鍵欄包含您可以在政策陳述式的 Condition 元素中指定的索引鍵。如需有關與服務資源相關聯之條件索引鍵的詳細資訊，請參閱「資源類型」資料表的條件索引鍵欄。

注意

資源條件索引鍵會列在資源類型資料表中。您可以在「動作」資料表的資源類型 (*必填) 欄中找到適用於動作的資源類型連結。「資源類型」資料表中的資源類型包括條件索引鍵欄，其中包含套用至「動作」資料表中動作的資源條件索引鍵。

如需下表各欄的詳細資訊，請參閱動作資料表。

動作	描述	存取層級	資源類型 (*必填項目)	條件索引鍵	相依動作
AbortMultipartUpload	准許中止分段上傳	寫入	object*
				s3:DataAccessPointArn s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
AssociateAccessGrantsIdentityCenter	准許關聯 Access Grants 身分中心	寫入	accessgrantsinstance*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
BypassGovernanceRetention	准許規避控管模式物件保留設定	許可管理	object*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-copy-source s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-metadata-directive s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id s3:x-amz-server-side-encryption-customer-algorithm s3:x-amz-storage-class s3:x-amz-website-redirect-location s3:object-lock-mode s3:object-lock-retain-until-date s3:object-lock-remaining-retention-days s3:object-lock-legal-hold
CreateAccessGrant	准許建立 Access Grants	寫入	accessgrantslocation*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey} aws:RequestTag/${TagKey} aws:TagKeys
CreateAccessGrantsInstance	准許建立 Access Grants 執行個體	寫入	accessgrantsinstance*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateAccessGrantsLocation	准許建立 Access Grants 位置	寫入	accessgrantsinstance*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey} aws:RequestTag/${TagKey} aws:TagKeys
CreateAccessPoint	准許建立新的存取點	寫入	accesspoint*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:locationconstraint s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256
CreateAccessPointForObjectLambda	准許建立物件 Lambda 啟用的存取點	寫入	objectlambdaaccesspoint*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
CreateBucket	准許建立新的儲存貯體	寫入	bucket*
				s3:authType s3:locationconstraint s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-object-ownership
CreateJob	准許建立新 Amazon S3 Batch Operations 任務	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:RequestJobPriority s3:RequestJobOperation aws:TagKeys aws:RequestTag/${TagKey}	iam:PassRole
CreateMultiRegionAccessPoint	准許建立新的多區域存取點	寫入	multiregionaccesspoint*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
CreateStorageLensGroup	准許建立 Amazon S3 Storage Lens 群組	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:RequestTag/${TagKey} aws:TagKeys
DeleteAccessGrant	准許刪除 Access Grant	寫入	accessgrant*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
DeleteAccessGrantsInstance	准許刪除 Access Grants 執行個體	寫入	accessgrantsinstance*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
DeleteAccessGrantsInstanceResourcePolicy	准許讀取 Access Grants 執行個體資源政策	寫入	accessgrantsinstance*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
DeleteAccessGrantsLocation	准許刪除 Access Grants 位置	寫入	accessgrantslocation*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
DeleteAccessPoint	准許刪除 URI 中命名的存取點	寫入	accesspoint*
				s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteAccessPointForObjectLambda	准許刪除 URI 中命名之物件 Lambda 啟用的存取點	寫入	objectlambdaaccesspoint*
				s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteAccessPointPolicy	准許在指定的存取點上刪除政策	許可管理	accesspoint*
				s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteAccessPointPolicyForObjectLambda	准許刪除指定物件 Lambda 啟用之存取點上的政策	許可管理	objectlambdaaccesspoint*
				s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteBucket	准許刪除 URI 中命名的儲存貯體	寫入	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteBucketPolicy	准許在指定的儲存貯體上刪除政策	許可管理	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteBucketWebsite	准許移除儲存貯體的網站組態	寫入	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteJobTagging	准許從現有的 Amazon S3 Batch Operations 任務中移除標籤	標記	job*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:ExistingJobPriority s3:ExistingJobOperation
DeleteMultiRegionAccessPoint	准許刪除 URI 中指定的多區域存取點	寫入	multiregionaccesspoint*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
DeleteObject	准許移除物件的 null 版本，然後插入刪除標記，這會變成物件的目前版本	寫入	object*
				s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteObjectTagging	准許使用 tagging 子資源，從指定的物件移除整個標籤組	標記	object*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteObjectVersion	准許移除特定物件版本	寫入	object*
				s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
DeleteObjectVersionTagging	准許移除特定物件版本的整個標籤集	標記	object*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
DeleteStorageLensConfiguration	准許刪除現有 Amazon S3 Storage Lens 組態	寫入	storagelensconfiguration*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteStorageLensConfigurationTagging	准許從現有 Amazon S3 Storage Lens 組態移除標籤	標記	storagelensconfiguration*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteStorageLensGroup	准許刪除現有的 S3 Storage Lens 群組	寫入	storagelensgroup*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DescribeJob	准許擷取批次操作任務的組態參數和狀態	讀取	job*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DescribeMultiRegionAccessPointOperation	准許擷取多區域存取點的組態	讀取	multiregionaccesspointrequestarn*
				s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
DissociateAccessGrantsIdentityCenter	准許取消 Access Grants 身分中心關聯	寫入	accessgrantsinstance*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetAccelerateConfiguration	准許使用 accelerate 子資源，傳回儲存貯體的 Transfer Acceleration 狀態，即已啟用或暫停	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccessGrant	准許讀取 Access Grant	讀取	accessgrant*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetAccessGrantsInstance	准許讀取 Access Grants 執行個體	讀取	accessgrantsinstance*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetAccessGrantsInstanceForPrefix	准許依字首讀取 Access Grants 執行個體執行個體	讀取	accessgrantsinstance*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetAccessGrantsInstanceResourcePolicy	准許讀取 Access Grants 執行個體資源政策	讀取	accessgrantsinstance*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetAccessGrantsLocation	准許讀取 Access Grants 位置	讀取	accessgrantslocation*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetAccessPoint	准許傳回有關指定存取點的組態資訊	讀取		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccessPointConfigurationForObjectLambda	准許擷取物件 Lambda 啟用之存取點的組態	讀取	objectlambdaaccesspoint*
				s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccessPointForObjectLambda	准許建立物件 Lambda 啟用的存取點	讀取	objectlambdaaccesspoint*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccessPointPolicy	准許傳回與指定存取點相關聯的存取點政策	讀取	accesspoint*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccessPointPolicyForObjectLambda	准許傳回與指定物件 Lambda 啟用的存取點相關聯的存取點政策	讀取	objectlambdaaccesspoint*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccessPointPolicyStatus	准許傳回特定存取點政策的政策狀態	讀取	accesspoint*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccessPointPolicyStatusForObjectLambda	准許傳回特定物件 Lambda 存取點政策的政策狀態	讀取	objectlambdaaccesspoint*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccountPublicAccessBlock	授與擷取 PublicAccessBlock 組態的權限 AWS 帳戶	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAnalyticsConfiguration	准許從 Amazon S3 儲存貯體取得分析組態 (由分析組態 ID 識別)	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketAcl	准許使用 acl 子資源傳回 Amazon S3 儲存貯體的存取控制清單 (ACL)	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketCORS	准許傳回針對 Amazon S3 儲存貯體設定的 CORS 組態資訊	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketLocation	准許傳回 Amazon S3 儲存貯體所在區域	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketLogging	准許傳回 Amazon S3 儲存貯體的記錄狀態，並准許使用者檢視或修改該狀態	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketNotification	准許取得 Amazon S3 儲存貯體的通知組態	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketObjectLockConfiguration	准許取得 Amazon S3 儲存貯體的物件鎖定組態	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:signatureversion
GetBucketOwnershipControls	授予在儲存貯體上擷取擁有權控制的許可	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketPolicy	准許傳回指定儲存貯體的政策	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketPolicyStatus	准許擷取特定 Amazon S3 儲存貯體的政策狀態，此狀態指出儲存貯體是否為公用	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketPublicAccessBlock	授予擷取 Amazon S3 儲存貯體 PublicAccessBlock 組態的權限	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketRequestPayment	准許傳回 Amazon S3 儲存貯體的請求付款組態	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketTagging	准許傳回與 Amazon S3 儲存貯體相關聯的標籤集	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketVersioning	准許傳回 Amazon S3 儲存貯體的版本控制狀態	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketWebsite	准許傳回 Amazon S3 儲存貯體的網站組態	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetDataAccess	准許取得存取權	讀取	accessgrantsinstance*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetEncryptionConfiguration	准許傳回 Amazon S3 儲存貯體的預設加密組態	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetIntelligentTieringConfiguration	准許取得或列出 S3 儲存貯體中的所有 Amazon S3 Intelligent Tiering 組態	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetInventoryConfiguration	准許從 Amazon S3 儲存貯體傳回庫存組態 (由庫存組態 ID 識別)	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetJobTagging	准許傳回現有 Amazon S3 Batch Operations 任務的標籤集	讀取	job*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetLifecycleConfiguration	准許傳回 Amazon S3 儲存貯體上的生命週期組態資訊集	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetMetricsConfiguration	准許從 Amazon S3 儲存貯體取得指標組態	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetMultiRegionAccessPoint	准許傳回有關指定多區域存取點的組態資訊	讀取	multiregionaccesspoint*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
GetMultiRegionAccessPointPolicy	准許傳回與指定多區域存取點相關聯的存取點政策	讀取	multiregionaccesspoint*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
GetMultiRegionAccessPointPolicyStatus	准許傳回特定多區域存取點政策的政策狀態	讀取	multiregionaccesspoint*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
GetMultiRegionAccessPointRoutes	准許傳回多區域存取點的路由組態	讀取	multiregionaccesspoint*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
GetObject	准許從 Amazon S3 擷取物件	讀取	object*
				s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectAcl	准許傳回物件的存取控制清單 (ACL)	讀取	object*
				s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectAttributes	准許擷取與特定物件相關聯的屬性	讀取	object*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectLegalHold	准許取得物件的目前法務保存狀態	讀取	object*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectRetention	准許擷取物件的保留設定	讀取	object*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectTagging	准許傳回物件的標籤集	讀取	object*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectTorrent	准許從 Amazon S3 儲存貯體傳回 torrent 檔案	讀取	object*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectVersion	准許擷取特定物件版本	讀取	object*
				s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
GetObjectVersionAcl	准許傳回特定物件版本的存取控制清單 (ACL)	讀取	object*
				s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
GetObjectVersionAttributes	准許擷取與特定物件版本相關的屬性	讀取	object*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
GetObjectVersionForReplication	准許同時複寫未加密物件和使用 SSE-S3 或 SSE-KMS 加密的物件	讀取	object*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectVersionTagging	准許傳回特定物件版本的標籤集	讀取	object*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
GetObjectVersionTorrent	准許使用 versionId 子資源取得有關不同版本的 Torrent 檔案	讀取	object*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
GetReplicationConfiguration	准許取得 Amazon S3 儲存貯體上的複寫組態資訊集	讀取	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetStorageLensConfiguration	准許取得 Amazon S3 Storage Lens 組態	讀取	storagelensconfiguration*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetStorageLensConfigurationTagging	准許取得現有 Amazon S3 Storage Lens 配置標籤集	讀取	storagelensconfiguration*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetStorageLensDashboard	准許取得 Amazon S3 Storage Lens 儀表板	讀取	storagelensconfiguration*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetStorageLensGroup	准許取得 Amazon S3 Storage Lens 群組	讀取	storagelensgroup*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
InitiateReplication [僅限許可]	准許將物件的複寫狀態設定為待定，以啟動複寫程序	寫入	object*
				s3:ResourceAccount
ListAccessGrants	准許列出 Access Grant	清單	accessgrantsinstance*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
ListAccessGrantsInstances	准許列出 Access Grants 執行個體	清單		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListAccessGrantsLocations	准許列出 Access Grants 位置	清單	accessgrantsinstance*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
ListAccessPoints	准許列出存取點	列出		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListAccessPointsForObjectLambda	准許列出物件 Lambda 啟用的存取點	列出		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListAllMyBuckets	准許列出已驗證的請求發送者擁有的所有儲存貯體	列出		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListBucket	准許列出 Amazon S3 儲存貯體中的部分或所有物件 (最多 1000 個)	列出	bucket*
				s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:delimiter s3:max-keys s3:prefix s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListBucketMultipartUploads	准許列出進行中的分段上傳	列出	bucket*
				s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListBucketVersions	准許列出有關 Amazon S3 儲存貯體中所有物件版本的中繼資料	列出	bucket*
				s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:delimiter s3:max-keys s3:prefix s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListJobs	准許列出目前任務和最近結束的任務	清單		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListMultiRegionAccessPoints	准許列出多區域存取點	清單		s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
ListMultipartUploadParts	准許列出特定分段上傳已上傳的部分	列出	object*
				s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListStorageLensConfigurations	准許列出 Amazon S3 Storage Lens 組態	清單		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListStorageLensGroups	准許列出 S3 Storage Lens 群組	清單		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListTagsForResource	准許列出連接至指定資源的標籤	清單	accessgrant
			accessgrantsinstance
			accessgrantslocation
			storagelensgroup
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ObjectOwnerOverrideToBucketOwner	准許變更複本所有權	許可管理	object*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PauseReplication [僅限許可]	授予暫停從目標來源儲存貯體到目標儲存貯體的 S3 複寫的權限	寫入	bucket*		S3:GetReplicationConfiguration S3:PutReplicationConfiguration
				s3:destinationRegion s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutAccelerateConfiguration	准許使用 accelerate 子資源，設定現有 S3 儲存貯體的 Transfer Acceleration 狀態	寫入	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutAccessGrantsInstanceResourcePolicy	准許放置 Access grants 執行個體資源政策	寫入	accessgrantsinstance*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
PutAccessPointConfigurationForObjectLambda	准許設定物件 Lambda 啟用之存取點的組態	寫入	objectlambdaaccesspoint*
				s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutAccessPointPolicy	准許將存取政策與指定存取點建立關聯	許可管理	accesspoint*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutAccessPointPolicyForObjectLambda	准許將指定物件 Lambda 啟用的存取點與存取政策建立關聯	許可管理	objectlambdaaccesspoint*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutAccessPointPublicAccessBlock	准許在建立存取點時將公開存取封鎖組態與指定的接入點建立關聯	許可管理
PutAccountPublicAccessBlock	授與建立或修改 PublicAccessBlock 組態的權限 AWS 帳戶	許可管理		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutAnalyticsConfiguration	准許設定儲存貯體的分析組態 (由分析組態 ID 指定)	寫入	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketAcl	准許使用存取控制清單 (ACL) 設定現有儲存貯體的許可	許可管理	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp
PutBucketCORS	准許設定 Amazon S3 儲存貯體的 CORS 組態	寫入	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketLogging	准許設定 Amazon S3 儲存貯體的記錄參數	寫入	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketNotification	准許在 Amazon S3 儲存貯體中發生特定事件時接收通知	寫入	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketObjectLockConfiguration	准許在特定儲存貯體上放置物件鎖定組態	寫入	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:TlsVersion s3:signatureversion
PutBucketOwnershipControls	准許在儲存貯體上新增、取代或刪除擁有權控制	寫入	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketPolicy	准許在儲存貯體上新增或取代儲存貯體政策	許可管理	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketPublicAccessBlock	授予建立或修改特定 Amazon S3 儲存貯體 PublicAccessBlock 組態的權限	許可管理	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketRequestPayment	准許設定儲存貯體的請求付款組態	寫入	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketTagging	准許將一組標籤新增至現有 Amazon S3 儲存貯體	標記	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketVersioning	准許設定現有 Amazon S3 儲存貯體的版本控制狀態	寫入	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketWebsite	准許針對 website 子資源中指定的網站，設定其組態	寫入	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutEncryptionConfiguration	准許設定 Amazon S3 儲存貯體的加密組態	寫入	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutIntelligentTieringConfiguration	准許建立新的或更新或刪除現有 Amazon S3 Intelligent Tiering 組態	寫入	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutInventoryConfiguration	准許將庫存組態 (由庫存 ID 識別) 新增至儲存貯體	寫入	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:InventoryAccessibleOptionalFields
PutJobTagging	准許取代現有 Amazon S3 Batch Operations 任務上的標籤	標記	job*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:ExistingJobPriority s3:ExistingJobOperation aws:TagKeys aws:RequestTag/${TagKey}
PutLifecycleConfiguration	准許為儲存貯體建立新的生命週期組態，或取代現有的生命週期組態	寫入	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutMetricsConfiguration	授與從 Amazon S3 儲存貯體設定或更新 CloudWatch 請求指標組態的權限	寫入	bucket*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutMultiRegionAccessPointPolicy	准許將存取政策與指定的多區域存取點建立關聯	許可管理	multiregionaccesspoint*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
PutObject	准許將物件新增至儲存貯體	寫入	object*
				s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-copy-source s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-metadata-directive s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id s3:x-amz-server-side-encryption-customer-algorithm s3:x-amz-storage-class s3:x-amz-website-redirect-location s3:object-lock-mode s3:object-lock-retain-until-date s3:object-lock-remaining-retention-days s3:object-lock-legal-hold
PutObjectAcl	准許針對於 S3 儲存貯體中新增或現有的物件設定存取控制清單 (ACL) 許可	許可管理	object*
				s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-storage-class
PutObjectLegalHold	准許將法務保存組態套用至指定物件	寫入	object*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:object-lock-legal-hold
PutObjectRetention	准許將物件保留組態放置在物件上	寫入	object*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:object-lock-mode s3:object-lock-retain-until-date s3:object-lock-remaining-retention-days
PutObjectTagging	准許將提供的標籤集設定為已存在於儲存貯體中的物件	標記	object*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutObjectVersionAcl	准許使用 acl 子資源，針對已存在於儲存貯體中的物件設定存取控制清單 (ACL)	許可管理	object*
				s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-storage-class
PutObjectVersionTagging	准許針對特定物件版本設定所提供的標籤集	標記	object*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
PutReplicationConfiguration	准許建立新的複寫組態或取代現有的複寫組態	寫入	bucket*		iam:PassRole
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:isReplicationPauseRequest
PutStorageLensConfiguration	准許建立或更新 Amazon S3 Storage Lens 組態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:TagKeys aws:RequestTag/${TagKey}
PutStorageLensConfigurationTagging	准許在現有 Amazon S3 Storage Lens 組態上放置或取代標籤	標記	storagelensconfiguration*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:TagKeys aws:RequestTag/${TagKey}
ReplicateDelete	准許將刪除標記複寫到目的地儲存貯體	寫入	object*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ReplicateObject	准許將物件和物件標籤複寫到目的地儲存貯體	寫入	object*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id s3:x-amz-server-side-encryption-customer-algorithm
ReplicateTags	准許將物件標籤複寫到目的地儲存貯體	標記	object*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
RestoreObject	准許將物件的封存複本還原到 Amazon S3	寫入	object*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
SubmitMultiRegionAccessPointRoutes	准許提交多區域存取點的路由組態更新	寫入	multiregionaccesspoint*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
TagResource	准許將標籤新增至指定資源	標記	accessgrant
			accessgrantsinstance
			accessgrantslocation
			storagelensgroup
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:TagKeys aws:RequestTag/${TagKey}
UntagResource	准許從指定的資源移除標籤	標記	accessgrant
			accessgrantsinstance
			accessgrantslocation
			storagelensgroup
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:TagKeys
UpdateAccessGrantsLocation	准許更新 Access grants 位置	寫入	accessgrantslocation*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
UpdateJobPriority	准許更新現有任務的優先順序	寫入	job*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:RequestJobPriority s3:ExistingJobPriority s3:ExistingJobOperation
UpdateJobStatus	准許更新指定任務的狀態	寫入	job*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:ExistingJobPriority s3:ExistingJobOperation s3:JobSuspendedCause
UpdateStorageLensGroup	准許更新現有的 S3 Storage Lens 群組	寫入	storagelensgroup*
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256

Amazon S3 定義的資源類型

此服務會定義下列資源類型，並可用在 IAM 許可政策陳述式的 Resource 元素中。動作資料表中的每個動作都會指明可使用該動作指定的資源類型。資源類型也能定義您可以在政策中包含哪些條件索引鍵。這些索引鍵都會顯示在表格的最後一欄。如需下表各欄的詳細資訊，請參閱資源類型表。

資源類型	ARN	條件索引鍵
accesspoint	arn:${Partition}:s3:${Region}:${Account}:accesspoint/${AccessPointName}
bucket	arn:${Partition}:s3:::${BucketName}
object	arn:${Partition}:s3:::${BucketName}/${ObjectName}
job	arn:${Partition}:s3:${Region}:${Account}:job/${JobId}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
storagelensconfiguration	arn:${Partition}:s3:${Region}:${Account}:storage-lens/${ConfigId}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
storagelensgroup	arn:${Partition}:s3:${Region}:${Account}:storage-lens-group/${Name}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
objectlambdaaccesspoint	arn:${Partition}:s3-object-lambda:${Region}:${Account}:accesspoint/${AccessPointName}
multiregionaccesspoint	arn:${Partition}:s3::${Account}:accesspoint/${AccessPointAlias}
multiregionaccesspointrequestarn	arn:${Partition}:s3:us-west-2:${Account}:async-request/mrap/${Operation}/${Token}
accessgrantsinstance	arn:${Partition}:s3:${Region}:${Account}:access-grants/default	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
accessgrantslocation	arn:${Partition}:s3:${Region}:${Account}:access-grants/default/location/${Token}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
accessgrant	arn:${Partition}:s3:${Region}:${Account}:access-grants/default/grant/${Token}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys

Amazon S3 的條件索引鍵

Amazon S3 定義下列條件索引鍵，可用於 IAM 政策的 Condition 元素中。您可以使用這些索引鍵來縮小套用政策陳述式的條件。如需下表各欄的詳細資訊，請參閱條件索引鍵資料表。

若要檢視所有服務都可使用的全域條件索引鍵，請參閱可用全域條件索引鍵。

條件索引鍵	描述	類型
aws:RequestTag/${TagKey}	依要求中傳遞的標籤來篩選存取權	字串
aws:ResourceTag/${TagKey}	依與資源關聯的標籤來篩選存取權	字串
aws:TagKeys	依要求中傳遞的標籤索引鍵來篩選存取權	ArrayOf字符串
s3:AccessGrantsInstanceArn	按訪問授予實例 ARN 過濾訪問	ARN
s3:AccessPointNetworkOrigin	依網路來源 (網際網路或 VPC) 篩選存取權	字串
s3:DataAccessPointAccount	依擁有存取點的 AWS 帳戶 ID 篩選存取	字串
s3:DataAccessPointArn	依存取點 Amazon Resource Name (ARN) 篩選存取權	ARN
s3:ExistingJobOperation	依操作篩選任務優先順序的更新存取權	字串
s3:ExistingJobPriority	依優先順序範圍篩選現有任務的取消存取權	數值
s3:ExistingObjectTag/<key>	依現有物件標籤鍵值篩選存取	字串
s3:InventoryAccessibleOptionalFields	透過限制使用者在設定 S3 庫存報告時可新增的選用中繼資料欄位來篩選存取	ArrayOf字符串
s3:JobSuspendedCause	依特定任務暫停原因篩選暫停任務的取消存取權 (例如，AWAITING_CONFIRMATION)	字串
s3:RequestJobOperation	依操作篩選任務的建立存取權	字串
s3:RequestJobPriority	依優先順序範圍篩選新任務的建立存取權	數值
s3:RequestObjectTag/<key>	依要新增至物件的標籤鍵值篩選存取	字串
s3:RequestObjectTagKeys	依要新增至物件的標籤鍵篩選存取	ArrayOf字符串
s3:ResourceAccount	依資源擁有者 AWS 帳戶 ID 篩選存取	字串
s3:TlsVersion	依用戶端所使用的 TLS 版本篩選存取權	數值
s3:authType	依身分驗證方法篩選存取	字串
s3:delimiter	依分隔符號參數篩選存取	字串
s3:destinationRegion	針對 AWS FIS 動作 aws 的目標值區域篩選特定複製目的地區域的存取：S3: 暫停-暫停複製	字串
s3:isReplicationPauseRequest	根據透過 AWS FIS 動作 aws: S3: 暫停-暫停複寫的要求篩選存取	Bool
s3:locationconstraint	依特定區域篩選存取權	字串
s3:max-keys	按 ListBucket 請求中返回的最大密鑰數過濾訪問	數值
s3:object-lock-legal-hold	依物件合法保留狀態篩選存取權	字串
s3:object-lock-mode	依物件保留模式 (符合性或控管) 篩選存取權	字串
s3:object-lock-remaining-retention-days	依剩餘的物件保留天數篩選存取權	數值
s3:object-lock-retain-until-date	依物件保留至日期篩選存取權	日期
s3:prefix	依金鑰名稱字首篩選存取權	字串
s3:signatureAge	依請求簽章的存在時間篩選存取權 (以毫秒為單位)	數值
s3:signatureversion	依要求所使用的 AWS 簽章版本篩選存取	字串
s3:versionid	依特定物件版本篩選存取權	字串
s3:x-amz-acl	透過要求 x-amz-acl 標頭中的固定 ACL 篩選存取	字串
s3:x-amz-content-sha256	篩選對儲存貯體中未簽署內容的存取	字串
s3:x-amz-copy-source	依複製來源儲存貯體、字首或複製來源請求中的物件來篩選存取權	字串
s3:x-amz-grant-full-control	通過 x-amz-grant-full-control（完全控制）頭過濾器訪問	字串
s3:x-amz-grant-read	依據 x-amz-grant-read (讀取存取權) 標頭篩選存取	字串
s3:x-amz-grant-read-acp	依 x-amz-grant-read-ACP (ACL 的讀取權限) 標頭篩選存取	字串
s3:x-amz-grant-write	通過 x-amz-grant-write （寫訪問）頭過濾訪問	字串
s3:x-amz-grant-write-acp	依 x-amz-grant-write-ACP (ACL 的寫入權限) 標頭篩選存取	字串
s3:x-amz-metadata-directive	複製物件時，依物件中繼資料行為 (COPY 或 REPLACE) 篩選存取權	字串
s3:x-amz-object-ownership	依物件擁有權篩選存取權	字串
s3:x-amz-server-side-encryption	依伺服器端加密篩選存取權	字串
s3:x-amz-server-side-encryption-aws-kms-key-id	篩選由 AWS KMS 客戶管理的 CMK 存取以進行伺服器端加密	ARN
s3:x-amz-server-side-encryption-customer-algorithm	依客戶指定的演算法篩選存取權，以進行伺服器端加密	字串
s3:x-amz-storage-class	依儲存類別篩選存取權	字串
s3:x-amz-website-redirect-location	針對設定為靜態網站的儲存貯體，依其特定網站重新導向位置篩選存取權	字串