---
title: "General information about access policies"
sidebar_label: "Bucket Policy"
sidebar_position: 1
description: "How Bucket Policy works: policy structure, rules, actions and conditions"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import {CustomTable, Icon} from '@selectel/docux/components'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'

# General information about bucket policies

Access to a bucket can be set via a Bucket Policy. A policy consists of [rules](#rules) that allow or deny [actions](#actions) on a [resource](#resources) (a bucket or group of objects) for all or selected [users](#users). The basic principle is: if a bucket policy is created, everything not explicitly allowed is denied.

The bucket policy applies to any authorized access. Authorized access includes viewing and managing buckets and their objects via the control panel and API. Unauthorized access includes requests to objects in public buckets via a [public bucket domain](/s3/manage/domains.mdx#bucket-public-domain) or [user domains](/s3/manage/domains.mdx#user-domain).

The Bucket Policy has a maximum size limit of 20 KB.

An access policy can apply to any user allowed access to the storage in accordance with the [role model](/access-control/access-management.mdx), and it also defines access for users with the roles [`s3.user`](/access-control/role-reference.mdx#s3-user), [`s3.bucket.user`](/access-control/role-reference.mdx#s3-bucket-user) and [`object_storage_user`](/access-control/role-reference.mdx#object-storage-user). Read more about the interaction between the role model and access policies in the [Managing Access in S3](/s3/about/manage-access.mdx) guide.

Access policies can be managed by the [Account Owner](/access-control/user-types.mdx#account-owner) and users with the [`member`](/access-control/role-reference.mdx#member) role. If a user with the `member` role has the **Projects** access area selected, the corresponding project must be added to their permissions.

[Access policies can be created](/s3/buckets/bucket-policy/create-policy.mdx) and managed in the control panel or via S3 API in accordance with the [policy structure](#policy-structure) requirements.

## Bucket Policy structure \{#policy-structure}

The Bucket Policy has a JSON structure. Example policy:

```json
{
  "Id": "my-bucket-policy",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowObjectDeletion",
      "Effect": "Allow",
      "Principal": {
          "AWS": [
             "*"
          ]
      },
      "Action": [
        "s3:DeleteObject"
      ],
      "Resource": [
        "arn:aws:s3:::bucket-name",


        "arn:aws:s3:::bucket-name/*",


        "arn:aws:s3:::bucket-name/${aws:userid}/*"


      ],
      "Condition": {
        "StringEquals": {
          "aws:UserAgent": [
            "storage-test-user-agent"
          ]
        }
      }
    },
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::bucket-name/*"


    }
  ]
}
```

Policy content:

<CustomTable>
  <table data-sticky>
    <thead>
      <tr>
        <th>Field</th><th>Description</th><th>Data type</th><th>Required</th>
      </tr>
    </thead>

    <tbody>
      <tr>
        <th>Id</th><td>Policy identifier, can be anything</td><td>String</td><td>✗</td>
      </tr>

      <tr>
        <th>Version</th><td>Bucket Policy version, value is a constant: <br />`"2012-10-17"`</td><td>String</td><td>✓</td>
      </tr>

      <tr>
        <th>Statement</th><td>Array of [rules](#rules)</td><td>Array</td><td>✓</td>
      </tr>

      <tr>
        <th>Sid</th><td>Rule name</td><td>String</td><td>✗</td>
      </tr>

      <tr>
        <th>Effect</th><td>Rule type (`Allow` or `Deny`)</td><td>String</td><td>✓</td>
      </tr>

      <tr>
        <th>Principal:AWS</th><td>[Users](#users) (specific user identifiers or `*` for all users)</td><td>Array of strings or string</td><td>✓</td>
      </tr>

      <tr>
        <th>Actions</th><td>[Actions](#actions) or `*` for all actions</td><td>Array of strings or string</td><td>✓</td>
      </tr>

      <tr>
        <th>Resources</th><td>[Resources](#resources) to which the rule applies</td><td>Array of strings or string</td><td>✓</td>
      </tr>

      <tr>
        <th>Condition</th><td>Array of [conditions](#conditions) presented in the following format: <br />`[operator]:[key]:[array of key values]`</td><td>Array</td><td>✗</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## Rules \{#rules}

There are two types of rules: allow (`Allow`) and deny (`Deny`).

The allow or deny rule applies to [actions](#actions), [resources](#resources), and [users](#users) added to the rule.

If a policy contains several rules, they are applied as follows:

* if at least one allow rule is met, access will be allowed;
* if at least one deny rule is met, access will be denied;
* if both allow and deny rules are met, access will be denied;
* if no rules are met, access will be denied.

### Users \{#users}

The rule applies to requests from principals (users):

* for authorized requests from specific users, specify user identifiers (you can [view the service user identifier](/access-control/manage/add-user.mdx#view-service-user-id) in the control panel);
* for all authorized requests, indicated by the `* symbol`.

You can add [panel users](/access-control/user-types.mdx#panel-users) as principals only when configuring the policy via the Control Panel.

### Resources \{#resources}

Resources are a bucket or a set of objects to which the rule applies. You can only specify resources associated with the bucket for which the policy is being configured.

Resources can be specified in the following formats:

* `arn:aws:s3:::<bucket-name>` — bucket resource, you can only specify one resource of this format (the bucket for which the policy is being configured). The resource will work for [actions](#actions) related to bucket configuration and does not apply to its objects ;
* `arn:aws:s3:::<bucket-name>/<prefix>` — bucket object resource, where `<prefix>` — the prefix the rule will apply to. If you specify `*`, all bucket objects will be included in the resources ;
* `arn:aws:s3:::<bucket-name>/${<variable-name>}` — bucket object resource, where `<variable-name>` — the name of the wildcard variable ([key](#keys)) that acts as a prefix.

## Actions \{#actions}

If you specify `*`, all actions will be included in the rule.

<CustomTable>
  <table data-sticky>
    <tbody>
      <tr>
        <th>s3:AbortMultipartUpload</th><td>Aborting [multiparts upload](/s3/objects/upload-object.mdx#segmented-upload) of an object via S3 API</td>
      </tr>

      <tr>
        <th>s3:DeleteBucket</th><td>[Deleting a bucket](/s3/buckets/delete-bucket.mdx)</td>
      </tr>

      <tr>
        <th>s3:DeleteObject</th><td>[Deleting an object](/s3/objects/delete-object.mdx)</td>
      </tr>

      <tr>
        <th>s3:DeleteObjectVersion</th><td>Deleting an object version</td>
      </tr>

      <tr>
        <th>s3:GetBucketCORS</th><td>Getting the [CORS configuration](/s3/buckets/cors.mdx) of a bucket</td>
      </tr>

      <tr>
        <th>s3:GetBucketLocation</th><td>Getting the [pool](/infrastructure/locations.mdx#pool) where the bucket is located</td>
      </tr>

      <tr>
        <th>s3:GetBucketVersioning</th><td>Getting bucket versioning information (whether it is enabled or not)</td>
      </tr>

      <tr>
        <th>s3:GetObject</th><td>Reading an object</td>
      </tr>

      <tr>
        <th>s3:GetObjectVersion</th><td>Reading a specific object version</td>
      </tr>

      <tr>
        <th>s3:ListBucket</th><td>Reading a list of objects in a bucket (all or some)</td>
      </tr>

      <tr>
        <th>s3:ListBucketMultipartUploads</th><td>Reading the list of objects in the process of [multipart upload](/s3/objects/upload-object.mdx#segmented-upload) via S3 API</td>
      </tr>

      <tr>
        <th>s3:ListBucketVersions</th><td>Reading metadata of all object versions in a bucket</td>
      </tr>

      <tr>
        <th>s3:ListMultipartUploadParts</th><td>Reading the list of uploaded object parts during [multipart upload](/s3/objects/upload-object.mdx#segmented-upload) via S3 API</td>
      </tr>

      <tr>
        <th>s3:PutBucketCORS</th><td>Setting bucket CORS configuration</td>
      </tr>

      <tr>
        <th>s3:PutBucketVersioning</th><td>Enabling or disabling bucket versioning</td>
      </tr>

      <tr>
        <th>s3:PutObject</th><td>Adding an object to a bucket ([upload](/s3/objects/upload-object.mdx) or [copy](/s3/objects/copy-object.mdx))</td>
      </tr>

      <tr>
        <th>s3:GetObjectRetention</th><td>Getting object temporary lock information</td>
      </tr>

      <tr>
        <th>s3:GetObjectLegalHold</th><td>Getting object indefinite lock information</td>
      </tr>

      <tr>
        <th>s3:GetBucketObjectLockConfiguration</th><td>Obtaining [Object Lock](/s3/buckets/object-lock.mdx) status and default locking in the bucket</td>
      </tr>

      <tr>
        <th>s3:PutObjectRetention</th><td>[Managing object temporary hold](/s3/objects/manage-object-lock.mdx#retention-period), except for disabling the lock</td>
      </tr>

      <tr>
        <th>s3:PutObjectLegalHold</th><td>[Managing object indefinite hold](/s3/objects/manage-object-lock.mdx#legal-hold)</td>
      </tr>

      <tr>
        <th>s3:PutBucketObjectLockConfiguration</th><td>Setting [Object Lock](/s3/buckets/object-lock.mdx) and default locking in the bucket</td>
      </tr>

      <tr>
        <th>s3:BypassGovernanceRetention</th><td>Bypassing Governance-mode lock to delete an object, edit expiration date, or change the temporary hold mode</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## Conditions \{#conditions}

A condition defines when a rule will work. A condition consists of a [key](#keys), an [operator](#operators), and a value.

If setting a condition results in a `true` value, the condition is satisfied.

### Keys \{#keys}

A single key can be used in several conditions. A key can be assigned several values.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>aws:CurrentTime</th><td>Compares the date and time of the request with the value specified in the condition</td>
      </tr>

      <tr>
        <th>aws:Referer</th><td>Compares the Referer header in the request with the value specified in the condition.<br /><br />Example: `https://example.com/`</td>
      </tr>

      <tr>
        <th>aws:PrincipalType</th>

        <td>
          Specifies the type of entity to which the request is made.

          Possible values:

          * `Account;`
          * `User;`
          * `AssumedRole;`
          * `Anonymous`
        </td>
      </tr>

      <tr>
        <th>aws:SecureTransport</th><td>Checks if the request was sent using SSL/TLS encryption.<br />Possible values: `true` or `false`</td>
      </tr>

      <tr>
        <th>aws:SourceIp</th><td>Compares the IP address from the request with the value from the condition</td>
      </tr>

      <tr>
        <th>aws:UserAgent</th>

        <td>
          Compares the UserAgent from the request with the value from the condition.

          Example values:

          * `Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0);`
          * `Gecko/20100101;`
          * `Firefox/47.0`
        </td>
      </tr>

      <tr>
        <th>aws:userid</th><td>Compares the [user](/access-control/access-management.mdx) identifier with the value from the condition.<br />Example value: `9103a81de217448d908e53ac60c84acb`</td>
      </tr>

      <tr>
        <th>aws:username</th><td>Compares the user name with the value from the condition</td>
      </tr>

      <tr>
        <th>s3:authType</th>

        <td>
          Restricts incoming requests to the authentication method specified in the condition.

          Example values:

          * `REST-HEADER;`
          * `REST-QUERY-STRING;`
          * `POST`
        </td>
      </tr>

      <tr>
        <th>s3:delimiter</th><td>Sets the delimiter that must be included in user requests.<br />Example value: `/`</td>
      </tr>

      <tr>
        <th>s3:max-keys</th><td>Sets the maximum number of keys returned per ListBucket request</td>
      </tr>

      <tr>
        <th>s3:prefix</th><td>Restricts access by the prefix in the key name</td>
      </tr>

      <tr>
        <th>s3:signatureAge</th><td>Determines the lifetime of the signature in the authentication request (in milliseconds)</td>
      </tr>

      <tr>
        <th>s3:signatureversion</th>

        <td>
          Sets the AWS signature version for authentication requests.

          Example values:

          * `AWS;`
          * `AWS4-HMAC-SHA256`
        </td>
      </tr>

      <tr>
        <th>s3:versionid</th>

        <td>
          Sets access to a specific object version.

          Example value: `L4kqtJlcpXroDTDmpUMLUo`
        </td>
      </tr>

      <tr>
        <th>s3:x-amz-content-sha256</th><td>Prohibits unsigned content in the request</td>
      </tr>

      <tr>
        <th>s3:x-amz-copy-source</th><td>Restricts copy source to a specific bucket, prefix, or object</td>
      </tr>

      <tr>
        <th>s3:x-amz-metadata-directive</th><td>Sets a forced choice of copying or replacing when copying objects</td>
      </tr>

      <tr>
        <th>s3:x-amz-server-side-encryption</th><td>Requires server-side encryption</td>
      </tr>

      <tr>
        <th>s3:x-amz-storage-class</th><td>Restricts access by storage class</td>
      </tr>

      <tr>
        <th>s3:object-lock-legal-hold</th>

        <td>
          Restricts access by object indefinite hold status.

          Possible hold status values:

          * `ON;`
          * `OFF`
        </td>
      </tr>

      <tr>
        <th>s3:object-lock-mode</th>

        <td>
          Restricts access by object lock mode.

          Possible lock mode values:

          * `GOVERNANCE;`
          * `COMPLIANCE`
        </td>
      </tr>

      <tr>
        <th>s3:object-lock-remaining-retention-days</th><td>Restricts access by the number of days remaining on the object lock</td>
      </tr>

      <tr>
        <th>s3:object-lock-retain-until-date</th><td>Restricts access by object lock expiration date</td>
      </tr>

      <tr>
        <th>s3:if-match</th><td>Requires that the current ETag of the object matches the one specified in the request</td>
      </tr>

      <tr>
        <th>s3:if-none-match</th><td>Requires that the current ETag of the object does not match the one specified in the request</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### Operators \{#operators}

Operators compare values from the resource request with the value specified in the key value in the condition.

<Tabs queryString="operators">
  <TabItem value="numbers" default>
    <TabItemLabel>
      Numbers
    </TabItemLabel>

    The number from the request is compared with the number specified in the condition.

    <CustomTable>
      <table>
        <tbody>
          <tr>
            <th>NumericEquals</th><td>Value is equal to the one specified in the condition</td>
          </tr>

          <tr>
            <th>NumericGreaterThan</th><td>Value is greater than the one specified in the condition</td>
          </tr>

          <tr>
            <th>NumericGreaterThanEquals</th><td>Value is greater than or equal to the one specified in the condition</td>
          </tr>

          <tr>
            <th>NumericLessThan</th><td>Value is less than the one specified in the condition</td>
          </tr>

          <tr>
            <th>NumericLessThanEquals</th><td>Value is less than or equal to the one specified in the condition</td>
          </tr>

          <tr>
            <th>NumericNotEquals</th><td>Value is not equal to the one specified in the condition</td>
          </tr>
        </tbody>
      </table>
    </CustomTable>
  </TabItem>

  <TabItem value="strings">
    <TabItemLabel>
      Strings
    </TabItemLabel>

    The string from the request is compared with the string specified in the condition.

    <CustomTable>
      <table>
        <tbody>
          <tr>
            <th>StringEquals</th><td>Value matches the one specified in the condition (case-sensitive)</td>
          </tr>

          <tr>
            <th>StringEqualsIgnoreCase</th><td>Value matches the one specified in the condition (case-insensitive)</td>
          </tr>

          <tr>
            <th>StringLike</th>

            <td>
              Value matches the pattern specified in the condition.

              Use wildcard characters:

              * `*` — for multiple characters;
              * — for a single character
            </td>
          </tr>

          <tr>
            <th>StringNotEqualsThan</th><td>Value does not match the one specified in the condition (case-sensitive)</td>
          </tr>

          <tr>
            <th>StringNotEqualsIgnoreCase</th><td>Value does not match the one specified in the condition (case-insensitive)</td>
          </tr>

          <tr>
            <th>StringNotLike</th>

            <td>
              Value does not match the pattern specified in the condition.

              Use wildcard characters:

              * `*` — for multiple characters;
              * — for a single character
            </td>
          </tr>
        </tbody>
      </table>
    </CustomTable>
  </TabItem>

  <TabItem value="date-and-time">
    <TabItemLabel>
      Date and time
    </TabItemLabel>

    The date and time from the request are compared with the date and time specified in the condition.

    <CustomTable>
      <table>
        <tbody>
          <tr>
            <th>DateEquals</th><td>Matches the specified date</td>
          </tr>

          <tr>
            <th>DateGreaterThan</th><td>Matches a date later than the specified one</td>
          </tr>

          <tr>
            <th>DateGreaterThanEquals</th><td>Matches the specified date or a later date</td>
          </tr>

          <tr>
            <th>DateLessThan</th><td>Matches a date earlier than the specified one</td>
          </tr>

          <tr>
            <th>DateLessThanEquals</th><td>Matches the specified date or an earlier date</td>
          </tr>

          <tr>
            <th>DateNotEquals</th><td>Does not match the specified date</td>
          </tr>
        </tbody>
      </table>
    </CustomTable>
  </TabItem>

  <TabItem value="ip">
    <TabItemLabel>
      IP addresses
    </TabItemLabel>

    The IP address in CIDR format from the request is compared with the IP address from the condition.

    <CustomTable>
      <table>
        <tbody>
          <tr>
            <th>IPAddress</th><td>Key value matches the specified IP address or is within the address range</td>
          </tr>

          <tr>
            <th>NotIPAddress</th><td>Key value does not match the specified IP address or is not within the address range</td>
          </tr>
        </tbody>
      </table>
    </CustomTable>
  </TabItem>

  <TabItem value="boolean">
    <TabItemLabel>
      Bool
    </TabItemLabel>

    The `Bool` operator compares the boolean value from the request (`true` or `false`) with the value from the key.

    The condition is satisfied if the value from the request matches the value from the condition.
  </TabItem>

  <TabItem value="ifexists">
    <TabItemLabel>
      IfExists
    </TabItemLabel>

    The `IfExists` operator allows you to relax the condition if the key specified in the condition is missing from the request.

    `IfExists` can only be used in conjunction with other operators (except `Null`). Addition format: `<operator-name>IfExists` — for example, `StringEqualsIfExists`.

    The data type corresponds to the data type of the operator to which `IfExists` is added.

    The satisfaction of the condition with `IfExists` depends on whether the key from the request is present in the condition.

    * if the key is present, the condition is processed according to the rules of the operator with which `IfExists` was used and can take the value `true` or `false`;
    * if the key is missing, the condition takes the value `true`.
  </TabItem>

  <TabItem value="null">
    <TabItemLabel>
      Null
    </TabItemLabel>

    The `Null` operator checks for the presence of the key from the request in the condition.

    Data type is boolean.

    The condition with the `Null` operator is satisfied:

    * if the key from the condition is missing in the request;
    * if the key is present in the request but its value is not specified.
  </TabItem>
</Tabs>

<Formbricks />