Bucket Policy
Data ProtectionA Bucket Policy is a resource-based IAM policy attached to an Amazon S3 bucket. It defines which principals (AWS accounts, IAM users/roles, or everyone) can perform which actions (GetObject, PutObject, DeleteBucket, etc.) on the bucket and its objects.
Common Use Cases
- Require encryption on all uploads (
s3:x-amz-server-side-encryption) - Enforce HTTPS-only access (
aws:SecureTransport) - Grant cross-account access to a specific role
- Restrict access to a VPC endpoint
- Block public access (in combination with S3 Block Public Access settings)
Related AWS Services
Related Content
Related Terms
A policy attached directly to an AWS resource (S3 bucket, SQS queue, KMS key) that defines who can access it, including principals from other accounts.
Protecting stored data by encrypting it on disk so that it cannot be read without the encryption key, even if the storage media is compromised.
When an AWS resource (S3 bucket, RDS instance, security group) is accessible from the internet, intentionally or accidentally, creating a potential security risk.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.