An S3 bucket policy is an object that allows you to manage access to specific buckets. They are structured with with JSON-based access policy language.
...
| Code Block |
|---|
|
s3cmd setpolicy policy.json s3://mybucket |
Sample scenarios
Grant any user read-access to the bucket:
| Code Block |
|---|
|
{
"Version": "2012-10-17",
"Id": "policy-read-any",
"Statement": [
{
"Sid": "read-any",
"Effect": "Allow",
"Principal": {
"AWS": [
"*"
]
},
"Action": [
"s3:ListBucket",
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::*"
]
}
]
} |
Grant any user read and write access to the bucket:
| Code Block |
|---|
|
{
"Version": "2012-10-17",
"Id": "policy-read-any",
"Statement": [
{
"Sid": "read-write-any",
"Effect": "Allow",
"Principal": {
"AWS": [
"*"
]
},
"Action": [
"s3:ListBucket",
"s3:GetObject",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::*"
]
}
]
} |
Put up IP restrictions to read and write to a bucket:
| Code Block |
|---|
|
{
"Sid": "AllowIP",
"Effect": "Deny",
"Principal": {
"AWS": ["*"]
},
"Action": [
"s3:ListBucket",
"s3:GetObject",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::*"
],
"Condition": {
"IpAddress": {
"aws:SourceIp": ["IP-ADDRESS/23"]
}
}
} |
Grant access to specific project credentials
| Code Block |
|---|
|
{
"Version": "2012-10-17",
"Id": "S3PolicySomeROSomeRW",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<PROJECT_ID>:root"
},
"Action": [
"s3:ListBucket",
"s3:GetObject",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::*"
]
},
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<PROJECT_ID>:root"
},
"Action": [
"s3:ListBucket",
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::*"
]
}
]
} |
...