Skip to main content
Access and security

Bucket policies

Allow or deny chosen actions on a bucket or folder, for the public or a sub-user.

A bucket policy is a set of rules that says who can do which actions on a bucket or on some of its folders. On the Policies page you build these rules with a short wizard — Zata writes the policy for you. Use it to give a sub-user exactly the access it needs, or to open part of a bucket to the public.

If you prefer to write the policy JSON yourself with an S3 tool, see What bucket policies support.

Create a policy​

Start the wizard

In the sidebar, open Policies and select Create Policy.

The Access Policies page with Create Policy and Refresh buttons, filters, and an empty policy list
Grantee: choose who gets access

Under Who should get access?, choose:

  • Public — anyone on the internet, with no sign-in. Then choose the Region of the bucket.
  • Subuser — one of your sub-users. Choose it under Select subuser. Only active sub-users are listed, and you can only pick buckets in the sub-user's own regions.

Select Next.

The Grantee step with Public and Subuser options and the Region dropdown showing Indore and Mumbai
Bucket and scope: choose where it applies

Under Select bucket, pick the bucket. Under Access scope, choose:

  • Entire bucket — the rule covers every file.
  • Specific folders — type a folder path (end it with /, for example reports/2026/) and select Add. Add as many folders as you need. If a folder does not exist yet, Zata offers to create it.
The Bucket and scope step with a bucket selected and the Entire bucket and Specific folders options
Permissions: choose the actions

Tick the actions to include, under Object operations and Bucket operations. The full list is in Actions you can choose.

The Permissions step with Object operations checkboxes such as Download files and Upload files
Review and create

Check the bucket, region, grantee and actions. Choose the Effect:

  • Allow grants the selected actions.
  • Deny blocks them, even if something else (such as an ACL) allows them.

Enter a Policy name (up to 120 characters). A name is required when your actions do not match one of the ready-made sets. Then select Create access policy.

The Review step showing bucket, region, grantee, effect, selected actions, scope details and a policy name field

If a policy already exists for the same bucket and grantee, the wizard ticks its current actions for you, and the button changes to Update existing policy — so you edit that policy instead of creating a duplicate.

Actions you can choose​

Console nameS3 actionPublicSub-user
Download filess3:GetObject✓✓
Download file versionss3:GetObjectVersion✓✓
Upload filess3:PutObject✓✓
Delete filess3:DeleteObject—✓
Delete file versionss3:DeleteObjectVersion—✓
View file permissionss3:GetObjectAcl✓✓
Change file permissionss3:PutObjectAcl——
View file tagss3:GetObjectTagging✓✓
Add/edit file tagss3:PutObjectTagging✓—
Remove file tagss3:DeleteObjectTagging✓✓
Cancel uploadss3:AbortMultipartUpload✓✓
View upload partss3:ListMultipartUploadParts✓✓
Restore archived filess3:RestoreObject✓✓
List filess3:ListBucket✓✓
List file versionss3:ListBucketVersions✓✓
List in-progress uploadss3:ListBucketMultipartUploads✓✓
View versioning statuss3:GetBucketVersioning✓✓
Change versionings3:PutBucketVersioning✓—
View bucket tagss3:GetBucketTagging✓✓
Manage bucket tagss3:PutBucketTagging✓—
  • Public policies only offer non-destructive actions: no delete and no permission changes.
  • Sub-users can never get Change file permissions, Add/edit file tags, Change versioning or Manage bucket tags.
  • With Specific folders, the bucket-wide settings (View versioning status, Change versioning, View bucket tags, Manage bucket tags) are not offered, and the listing actions only list inside the chosen folders.

Upload files for Public lets anyone on the internet add and overwrite files in that bucket or folder, and you pay for what they store. Use it only when you really mean it.

Manage policies​

Your policies appear as cards on the Policies page, grouped by grantee — a section for each sub-user, plus one for Public. Use the filters to find one by bucket, name or action, or by status (Active, Suspended, Expired).

The Access Policies list showing a new Active policy card with its bucket, preset, scope and number of actions

Select a card to see its effect, scope, grantee, folders and actions. From there you can:

  • Edit — change the scope, effect, actions or name, then Save changes.
  • Suspend — turn the policy off for now without deleting it. Resume turns it back on.
  • Delete — remove the policy for good.

Sub-users can ask you for more actions on a policy they already have. Their requests appear under Policy Requests on the Policies page — see Sub-user policies and requests.

Next steps​