General information about bucket policies
Access to a bucket can be set through a Bucket Policy. A policy consists of rules that allow or prohibit actions with a resource (a bucket or a group of objects) for all or selected users. The basic principle is that if a policy is created, everything that is not allowed is prohibited.
Bucket Policy applies to any authorized access. Authorized access is considered to be viewing and managing buckets and their objects through the control panel and API. Unauthorized access is considered to be requests to objects in public buckets via the public bucket domain or custom domains.
The Bucket Policy has a maximum size limit of 20 KB.
Bucket Policy can apply to any user who is allowed access to the storage according to the role model, and also defines access for users with s3.user, s3.bucket.user, and object_storage_user roles. For more information about the interaction between the role model and access policies, see the Managing Access in S3 guide.
Bucket policies can be managed by the Account Owner and users with the member role. If a user with the member role has the Projects access area selected, the corresponding project must be added to their permission.
Access policies can be created and managed in the control panel or via S3 API in accordance with the policy structure requirements.
Bucket Policy structure
The Bucket Policy has a JSON structure. Example policy:
{
"Id": "my-bucket-policy",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowObjectDeletion",
"Effect": "Allow",
"Principal": {
"AWS": [
"*"
]
},
"Action": [
"s3:DeleteObject"
],
"Resource": [
"arn:aws:s3:::bucket-name",
"arn:aws:s3:::bucket-name/*",
"arn:aws:s3:::bucket-name/${aws:userid}/*"
],
"Condition": {
"StringEquals": {
"aws:UserAgent": [
"storage-test-user-agent"
]
}
}
},
{
"Effect": "Deny",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::bucket-name/*"
}
]
}
Policy content:
Rules
There are two types of rules: allow (Allow) and deny (Deny).
The allow or deny rule applies to actions, resources, and users added to the rule.
If a policy contains several rules, they are applied as follows:
- if at least one allow rule is met, access will be allowed;
- if at least one deny rule is met, access will be denied;
- if both allow and deny rules are met, access will be denied;
- if no rules are met, access will be denied.
Users
The rule applies to requests from principals (users):
- for authorized requests from specific users, specify user identifiers (you can view the service user identifier in the control panel);
- for all authorized requests, indicated by the
* symbol.
You can only add users with access to the control panel as principals when configuring a policy through the control panel.
Resources
Resources are a bucket or a set of objects to which the rule applies. You can only specify resources associated with the bucket for which the policy is being configured.
Resources can be specified in the following formats:
arn:aws:s3:::<bucket-name>— bucket resource, you can only specify one resource of this format (the bucket for which the policy is being configured). The resource will work for actions related to bucket configuration and does not apply to its objects ;arn:aws:s3:::<bucket-name>/<prefix>— bucket object resource, where<prefix>— the prefix the rule will apply to. If you specify*, all bucket objects will be included in the resources ;arn:aws:s3:::<bucket-name>/${<variable-name>}— bucket object resource, where<variable-name>— the name of the wildcard variable (key) that acts as a prefix.
Actions
If you specify *, all actions will be included in the rule.
Conditions
A condition defines when a rule will work. A condition consists of a key, an operator, and a value.
If setting a condition results in a true value, the condition is satisfied.
Keys
A single key can be used in several conditions. A key can be assigned several values.
Operators
Operators compare values from the resource request with the value specified in the key value in the condition.
Numbers
Strings
Date and time
IP addresses
Bool
IfExists
Null
The number from the request is compared with the number specified in the condition.