title: “S3 Bucket Policies” created: 2026-07-20 updated: 2026-07-20 type: knowledge tags:

aws
s3
security
iam
certification

S3 Bucket Policies

What It Is

A bucket policy is a resource-based JSON policy attached directly to an S3 bucket. It defines who can do what on which resources within that bucket.

Bucket policies are the primary mechanism for controlling S3 access in modern AWS. They appear in nearly every exam scenario involving cross-account access, public websites, or EC2-to-S3 connectivity.

Key Concepts

Policy Structure (JSON)

{
  "Version": "2012-10-17",
  "Id": "PolicyId",
  "Statement": [
    {
      "Sid": "StatementId",
      "Effect": "Allow | Deny",
      "Principal": "who",
      "Action": ["what operations"],
      "Resource": "which bucket/objects"
    }
  ]
}

Key Elements

Element	Description	Example
Effect	Allow or Deny	`"Allow"`
Principal	Who gets access (ARN, `*` for everyone)	`"arn:aws:iam::123456:role/MyRole"`
Action	S3 API operations	`"s3:GetObject"`, `"s3:PutObject"`
Resource	Bucket and/or objects (ARN)	`"arn:aws:s3:::mybucket/*"`
Condition	Optional constraints (IP, date, etc.)	`"IpAddress": {"aws:SourceIp": "x.x.x.x"}`

Common Actions

s3:GetObject — download/read objects
s3:PutObject — upload objects
s3:DeleteObject — delete objects
s3:ListBucket — list objects in bucket (resource = bucket ARN, not /*)
s3:GetObjectVersion — read a specific version (versioning)

Resource ARN Patterns

Bucket-level: arn:aws:s3:::mybucket (for ListBucket)
Object-level: arn:aws:s3:::mybucket/* (for Get/Put/Delete)
The /* suffix is critical — without it, object operations won’t match

AWS Policy Generator

A web-based tool at https://awspolicygen.s3.amazonaws.com/policygen.html that helps you build policies visually without writing JSON by hand.

Multiple Statements

A policy can contain multiple statements. Example: one statement granting EC2 role PutObject/GetObject, another granting everyone GetObject (public read).

Gotchas

Forgetting /* at the end of the Resource ARN for object operations = policy won’t work
Principal: "*" = anyone in the world (use with extreme caution)
Explicit Deny always overrides Allow
Bucket policies are limited to 20 KB
BPA can still block a permissive bucket policy if BlockPublicPolicy is enabled

AWS Certification Notes