Working with Amazon S3 Buckets

Working with Amazon S3 Bucket Policies

A bucket policy is a JSON document that controls access to a bucket and the files it contains. You can grant or deny access based on the requester, action, file path, and optional conditions such as an IP address.

Each bucket has a single bucket policy document. Editing the policy replaces the current document.

To edit an Amazon S3 Bucket Policy

1. Select the bucket whose policy you want to edit.

2. Open the Buckets menu and choose Edit Bucket Policy..

   

   The Bucket Policy Editor dialog will open:

   

3. Enter or edit a valid JSON policy, then click Apply.

To remove the current bucket policy, click remove policy, then click Apply. The link clears the editor; the stored policy is deleted only after you apply the change.

See the examples below. For more details, see Policies and permissions in Amazon S3 and the official bucket policy examples.

Examples of Amazon S3 Bucket Policies

Replace the sample bucket name, IAM role, and network range with your own values before applying a policy. Test the result carefully to avoid granting unintended access.

Grant public-read access to files in a folder

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowPublicRead",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-brand-new-bucket/public-folder/*"
    }
  ]
}

Grant an IAM role access to a bucket and its files

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowRoleBucketOperations",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/MyS3Role"
      },
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": "arn:aws:s3:::my-brand-new-bucket"
    },
    {
      "Sid": "AllowRoleFileOperations",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/MyS3Role"
      },
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::my-brand-new-bucket/*"
    }
  ]
}

Replace the account ID and role name with the ARN of an existing IAM role. Additional permissions may be required for file versions, multipart uploads, or AWS KMS encryption.

Grant public-read access from a specific IP address range

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAnonymousReadFromSpecificPublicCidr",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-brand-new-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "192.0.2.0/24"
        }
      }
    }
  ]
}

The range 192.0.2.0/24 is reserved for documentation; replace it with your public network range. This statement does not revoke access granted by other policies.

For requests through an Amazon VPC endpoint, use aws:SourceVpc, aws:SourceVpce, or aws:VpcSourceIp instead of aws:SourceIp.