Loading tool
Generate S3 bucket policies from AWS Policy Generator action metadata and export JSON, Terraform, or CloudFormation snippets.
Step 1
Set the sample bucket name used when adding generated S3 bucket and object resources.
Step 2
The action list is scoped to AWS Policy Generator's S3 Bucket Policy actions.
Step 3
No S3 actions selected yet.
Search for an S3 action above to start generating a bucket policy.
This generator uses AWS Policy Generator's S3 Bucket Policy action list and enriches it with Amazon S3 Service Authorization Reference metadata so you can build bucket policies with actions, principals, bucket or object resources, and condition keys in one place.
S3 bucket policies include a Principal element because the policy lives on the bucket and defines who can list, read, write, tag, or manage S3 resources at the bucket boundary.
Need a different policy type? Switch to the IAM policy generator, SNS topic policy generator, SQS queue policy generator, or VPC endpoint policy generator.
Use an IAM identity policy to grant permissions to users, roles, or applications in your account. Use an S3 bucket policy when access must be controlled on the bucket itself, especially for cross-account access, public access exceptions, service integrations, or organization-wide guardrails.
S3 bucket policies are resource policies. The Principal element identifies who the statement applies to, such as an AWS account, IAM role ARN, federated principal, AWS service principal, or wildcard.
Bucket-level actions such as s3:ListBucket usually use arn:aws:s3:::bucket-name. Object-level actions such as s3:GetObject and s3:PutObject usually use arn:aws:s3:::bucket-name/* or a narrower object prefix.
Yes. Service principals are useful when another AWS service needs access to the bucket. The generator reuses the generated AWS service principal dataset so you can search for entries such as logging.s3.amazonaws.com, cloudtrail.amazonaws.com, or delivery.logs.amazonaws.com.
You can use *, but S3 bucket policies are usually safer when scoped to explicit bucket or object ARNs. Wildcards are useful for drafts or broad administrative statements, but production policies should normally target the exact bucket and prefix that need access.
Yes. The JSON output is a standard S3 bucket policy document, the Terraform output includes an aws_iam_policy_document data source with aws_s3_bucket_policy, and the CloudFormation output creates an AWS::S3::BucketPolicy snippet.
Related tools
Generate VPC endpoint policies from AWS Policy Generator action metadata and export JSON, Terraform, or CloudFormation snippets.
Generate SQS queue policies from AWS Policy Generator action metadata and export JSON, Terraform, or CloudFormation snippets.
Generate SNS topic policies from AWS Policy Generator action metadata and export JSON, Terraform, or CloudFormation snippets.
Next step
I build these tools to make AWS easier to manage. If this level of quality is what you want in your own cloud platform, Towards The Cloud can help with landing zones, infrastructure as code, security reviews, migrations, and cost optimization.