Identity and Bucket Policy Reference

Identity and bucket policies support a subset of elements listed in Amazon's IAM JSON Policy Reference.

Both identity and bucket policies comprise a series of statements. Each statement allows or denies a set of S3 actions on a set of S3 resources.

The identity policy syntax is:

  {
      "Version": "2012-10-17",
      "Statement": [{
          "Sid": "<SID>",
          ("Action" | "NotAction"): (
              "s3:<ACTION>" | 
              ["s3:<ACTION1>", "s3:<ACTION2>", ...] |
              "*"),
          "Effect": (
              "Allow" | 
              "Deny"),
          ("Resource" | "NotResource"): (
              [<resource1>, <resource2>, ...] |
              "*"), 
          "Condition": {"<operator>": {"<key>": "<value>"}}
      }]
    } 

The bucket policy syntax is:

  {
      "Version": "2012-10-17",
      "Statement": [{
          "Sid": "<SID>",
          "Principal": (
              "User": "<username@domainname>" | 
              "User": ["<username1@domainname1>", "<username2@domainname2>", ...] |
              "Group": "<groupname@domainname>" |    
              "Group": ["<groupname1@domainname1>", "<groupname2@domainname2>", ...] |
              "*")
          ("Action" | "NotAction"): (
              "s3:<ACTION>" | 
              ["s3:<ACTION1>", "s3:<ACTION2>", ...] |
              "*"),
          "Effect": (
              "Allow" | 
              "Deny"),
          ("Resource" | "NotResource"): (
              [<resource1>, <resource2>, ...] |
              "*"), 
          "Condition": {"<operator>": {"<key>": "<value>"}}
      }]
    } 

Syntax rules and conventions:

The following AWS IAM JSON policy condition operators are supported in identity and bucket policies.

The IfExists suffix means that if the condition key is not present in the request context, the policy statement is evaluated as a match (true) and the policy effect applies.

The following AWS IAM JSON policy condition keys can be included in the Condition element of an identity or bucket policy to compare a value from the request to the value specified in the policy:

The ForAllValues and ForAnyValue qualifiers let you compare request context keys with multiple values against a set of multiple values in a policy condition statement.

The following  AWS IAM JSON policy variables can be included in the resource names under the Resource and element and in condition values under the Condition element:

For example:

"Condition" : {
  "StringEquals" : { 
    "s3:x-amz-grant-read"; : "id=${BucketName}"
    },

The following identity policy grants a user access to one of your buckets, bucket1, and allows the user to add, update and delete objects.

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Action": "s3:ListAllMyBuckets",
         "Resource":"*"
      },
      {
         "Effect":"Allow",
         "Action":["s3:ListObjects","s3:GetBucketLocation"],
         "Resource":"arn:aws:s3:::bucket1"
      },
      {
         "Effect":"Allow",
         "Action":[
            "s3:PutObject",
            "s3:PutObjectAcl",
            "s3:GetObject",
            "s3:GetObjectAcl",
            "s3:DeleteObject"
         ],
         "Resource":"arn:aws:s3:::bucket1/*"
      }
   ]
}

The following identity policy grants permission to perform the GetObject action on all objects in the bucket dev:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Allow All GetObject in dev Bucket",
      "Action": [
        "s3:GetObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::dev/*"
    }
  ]
}

The following identity policy grants permission for multiple actions on the bucket product and on all objects in the same bucket, while also denying delete permission on the same bucket and objects.

{  "Version": "2012-10-17",
  "Statement": [
    {      
       "Sid": "Allow multiple actions on product bucket and its objects",
      "Action": [
        "s3:Get*",
        "s3:Put*",
        "s3:Head*",
        "s3:List*"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::product",
        "arn:aws:s3:::product/*"
      ]
    },
    {
      "Sid": "Deny delete product bucket and objects",
      "Action": [
        "s3:DeleteBucket",
        "s3:DeleteObject"
      ],
      "Effect": "Deny",
      "Resource": [
        "arn:aws:s3:::product",
        "arn:aws:s3:::product/*"
      ]
    }
  ]}

The following bucket policy allows users from the students group to read objects in bucket bucket1:

{
    "Version": "2012-10-17",
    "Statement": [
        {     
            "Sid": "Let students read", 
            "Effect": "Allow",   
            "Principal":  {"Group": "students@example.com"},   
            "Action": [ "s3:GetObject", "s3:ListBucket" ],
            "Resource": ["arn:aws:s3:::bucket1","arn:aws:s3:::bucket1/*"]
        }
    ]
}

The following bucket policy prohibits users Kevin and Martin from reading objects object with an object tag of 'category' with a value 'reports':

{
   "Version":"2012-10-17",
   "Statement":[{
         "Principal":{ "User": ["kevin@example.com", "martin@example.com"]},
         "Effect":"Deny",
         "Action":["s3:GetObject", "s3:GetObjectVersion"],
         "Resource": ["arn:aws:s3:::bucket1/*"],
         "Condition":{"StringEquals":{"s3:ExistingObjectTag/category":"reports"}}
   }]     
}