S3 Bucket Policy Generator

Create an AWS S3 Bucket Policy

Use this S3 Bucket Policy Generator to create a JSON resource policy for an Amazon S3 bucket without manually assembling every policy element. Enter the bucket name, select a preset or build a custom statement, choose the principal and S3 actions, set the resource scope, and add optional conditions. The tool generates the policy JSON and an AWS CLI command that you can review and copy.

An S3 bucket policy controls who can perform specified actions on a bucket or its objects and under which conditions. Treat the generated policy as a starting point: always verify the principal, actions, resources and conditions before applying it to AWS.

How to Create an S3 Bucket Policy

1. Enter the bucket name: Use the exact S3 bucket name. The generator uses it to create bucket and object ARNs.
2. Choose a preset: Select Public Read, IP Restriction, Cross-Account Access, HTTPS Only or a blank policy, depending on your goal.
3. Set the effect: Choose Allow to grant the selected permissions or Deny to explicitly block them.
4. Specify the principal: Identify the AWS account, IAM role or other principal affected by the statement. Use * only when anonymous public access is intentional.
5. Select S3 actions: Choose only the operations required, such as s3:GetObject, s3:PutObject or s3:ListBucket.
6. Select the resource scope: Use the bucket ARN for bucket-level actions and the object ARN ending in /* for object-level actions.
7. Add conditions if required: Restrict access by source IP, require HTTPS or apply another supported condition.
8. Generate and review: Inspect every statement, then copy the JSON or the generated AWS CLI command.

S3 Bucket Policy Fields Explained

Worked Example: Create a Public-Read S3 Policy

Suppose the bucket my-example-bucket contains public website images. Visitors should be able to download objects, but they must not upload, overwrite or delete them. Configure the generator with Allow, principal *, action s3:GetObject, and object resource arn:aws:s3:::my-example-bucket/*.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-example-bucket/*"
    }
  ]
}

This example makes every object covered by the resource publicly readable. It does not grant upload, delete or bucket-listing permission. Amazon S3 Block Public Access settings can reject or override public access. Keep public access blocked unless the bucket is intentionally public and you understand the exposure.

Bucket-Level and Object-Level Resources

Choosing the correct ARN is essential. Bucket-level actions such as s3:ListBucket normally use arn:aws:s3:::my-example-bucket. Object-level actions such as s3:GetObject, s3:PutObject and s3:DeleteObject normally use arn:aws:s3:::my-example-bucket/*. A policy can require separate statements when it combines bucket-level and object-level actions.

How to Add the Generated Policy in AWS

1. Open Amazon S3 in the AWS Management Console.
2. Select the required general-purpose bucket.
3. Open the Permissions tab.
4. Under Bucket policy, choose Edit.
5. Paste the reviewed JSON and choose Save changes.
6. Test with the intended IAM role, account or request source.

You can also save the JSON as policy.json and apply it with the generated AWS CLI command:

aws s3api put-bucket-policy \
  --bucket my-example-bucket \
  --policy file://policy.json

Common Errors

• Policy has invalid resource: Confirm that the ARN contains the exact bucket name and uses /* for object actions.
• Invalid principal: Verify the AWS account ID or IAM role ARN and confirm that the referenced identity exists.
• Access Denied: Check IAM policies, explicit denies, service control policies and Block Public Access settings.
• Objects work but listing fails: s3:GetObject does not include s3:ListBucket; they use different resources.
• Public-read policy does not work: Account-, organization- or bucket-level Block Public Access may still prevent public access.
• Overly broad access: Avoid wildcard principals, actions and resources unless they are deliberately required.

Best Practices

• Grant the minimum actions and resources required.
• Keep S3 Block Public Access enabled by default.
• Use IAM role ARNs instead of long-term user credentials where practical.
• Add an explicit HTTPS-only deny rule for production data when appropriate.
• Test allowed and denied operations before deploying to production.
• Remember that an applicable explicit Deny overrides an Allow.

Generator Limitations

Correctly formatted JSON is not a guarantee that a policy is secure or that AWS will allow the request. Final access can depend on IAM policies, permissions boundaries, session policies, service control policies, resource ownership and S3 Block Public Access. Review and test the generated policy with the actual AWS identities and resources.

Related AWS Tools

• AWS IAM Policy Generator – create identity-based permissions for users and roles.
• IAM Policy Validator – review an IAM policy before deployment.
• JSON Formatter – format and inspect JSON policy documents.

Frequently Asked Questions