What bucket policies support

The actions, principals and condition keys Zata accepts in a bucket policy.

Zata supports a subset of the AWS S3 bucket policy language. Use this page when you write a policy as JSON and apply it with an S3 tool. The easiest and safest way is still the Policies page in the Zata console, which builds a valid policy for you.

Only the bucket owner can set, read or delete a bucket policy. Sub-users cannot.

Example

This policy lets one user list the reports/ folder of my-bucket and download files from it:

policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": ["arn:aws:iam:::user/YOUR_USER_ID"] },
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::my-bucket/reports/*"]
    },
    {
      "Effect": "Allow",
      "Principal": { "AWS": ["arn:aws:iam:::user/YOUR_USER_ID"] },
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::my-bucket"],
      "Condition": { "StringLike": { "s3:prefix": ["reports/*"] } }
    }
  ]
}

Apply, check and remove it with the AWS CLI (profile zata):

aws s3api put-bucket-policy --bucket my-bucket --policy file://policy.json --profile zata
aws s3api get-bucket-policy --bucket my-bucket --profile zata
aws s3api delete-bucket-policy --bucket my-bucket --profile zata

If a policy is refused, the error message shows which part is wrong. Remove one unsupported part at a time and try again.

Principals

Who	Principal
Anyone (public)	"*"
One Zata user or sub-user	{ "AWS": ["arn:aws:iam:::user/YOUR_USER_ID"] }

Zata uses its own user IDs, not 12-digit AWS account IDs. The simplest way to get a sub-user's principal right is to create a policy for it on the Policies page, then read it back with get-bucket-policy.

Actions

These are the actions you can grant in a Zata bucket policy, written as s3:<Action>:

Group	Actions
Files	GetObject, GetObjectVersion, PutObject, DeleteObject, DeleteObjectVersion, GetObjectAcl, PutObjectAcl, GetObjectTagging, PutObjectTagging, DeleteObjectTagging, AbortMultipartUpload, ListMultipartUploadParts, RestoreObject
Bucket	ListBucket, ListBucketVersions, ListBucketMultipartUploads, GetBucketVersioning, PutBucketVersioning, GetBucketTagging, PutBucketTagging
Object Lock	PutObjectRetention, GetObjectRetention, PutObjectLegalHold, GetObjectLegalHold, BypassGovernanceRetention

• Sub-users can never be given PutObjectAcl, PutObjectTagging, PutBucketVersioning or PutBucketTagging.
• The Object Lock actions are not on the Policies page, and sub-users cannot request them. See Object Lock.
• Your own (root) keys can already do everything in your account. Policies are only for giving access to others.

Any other S3 action is not offered in Zata policies.

Condition keys

General keys (all requests): aws:CurrentTime, aws:EpochTime, aws:PrincipalType, aws:Referer, aws:SecureTransport, aws:SourceIp, aws:UserAgent, aws:username.

S3 keys:

Condition key	Used with
s3:prefix, s3:delimiter, s3:max-keys	ListBucket, ListBucketVersions
s3:x-amz-acl, s3:x-amz-grant-<perm>	PutObject, PutObjectAcl
s3:x-amz-copy-source, s3:x-amz-metadata-directive, s3:RequestObjectTag/<key>	PutObject
s3:ExistingObjectTag/<key>	GetObject, GetObjectVersion, GetObjectAcl, object tagging

To limit access by IP address, use the aws:SourceIp key with the IpAddress or NotIpAddress condition operator. These are condition operators, not actions.

Not supported

• IAM user, group and role policies. Zata has bucket policies only. Giving access to a whole account gives it to every user in that account.
• AWS account IDs in Principal.
• Policy variables such as ${aws:username} in Resource or conditions.
• Condition keys not listed above, for example aws:SourceArn, aws:SourceAccount, aws:SourceVpc, aws:SourceVpce, aws:PrincipalTag/*, aws:RequestTag/*, aws:MultiFactorAuthPresent.
• Actions not listed above, for example s3:PutBucketOwnershipControls, s3:PutEncryptionConfiguration, s3:GetObjectAttributes, s3:PutInventoryConfiguration.

For other access errors, see Access denied.