# Applying Limitations with Bucket Policies

We have support a subset of the Amazon s3 policy language applied to buckets.

## Policy Creation and Removal

Bucket policies are managed through standard S3 operations.

For example, I have created a policy to access objects inside the bucket.

```
{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"AWS": ["arn:aws:iam:::user/4fe084dd-8531-4087-bc89-91cca2c9ea8d:Access"]},
      "Action": "s3:GetObject",
      "Resource": [
        "arn:aws:s3:::pankimages/*"
      ]
    }]
  }
```

## Limitations

Currently, we support only the following actions:

* s3:AbortMultipartUpload
* s3:CreateBucket
* s3:DeleteBucketPolicy
* s3:DeleteBucket
* s3:DeleteBucketWebsite
* s3:DeleteObject
* s3:DeleteObjectVersion
* s3:DeleteReplicationConfiguration
* s3:GetAccelerateConfiguration
* s3:GetBucketAcl
* s3:GetBucketCORS
* s3:GetBucketLocation
* s3:GetBucketLogging
* s3:GetBucketNotification
* s3:GetBucketPolicy
* s3:GetBucketRequestPayment
* s3:GetBucketTagging
* s3:GetBucketVersioning
* s3:GetBucketWebsite
* s3:GetLifecycleConfiguration
* s3:GetObjectAcl
* s3:GetObject
* s3:GetObjectTorrent
* s3:GetObjectVersionAcl
* s3:GetObjectVersion
* s3:GetObjectVersionTorrent
* s3:GetReplicationConfiguration
* s3:IPAddress
* s3:NotIpAddress
* s3:ListAllMyBuckets
* s3:ListBucketMultipartUploads
* s3:ListBucket
* s3:ListBucketVersions
* s3:ListMultipartUploadParts
* s3:PutAccelerateConfiguration
* s3:PutBucketAcl
* s3:PutBucketCORS
* s3:PutBucketLogging
* s3:PutBucketNotification
* s3:PutBucketPolicy
* s3:PutBucketRequestPayment
* s3:PutBucketTagging
* s3:PutBucketVersioning
* s3:PutBucketWebsite
* s3:PutLifecycleConfiguration
* s3:PutObjectAcl
* s3:PutObject
* s3:PutObjectVersionAcl
* s3:PutReplicationConfiguration
* s3:RestoreObject

Instead of the Amazon twelve-digit account ID, we utilize the RGW 'tenant' identifier. In the future, assigning an account ID to a tenant may be possible. However, for now, when creating users for policies between AWS S3 and RGW S3, you must use the Amazon account ID as the tenant ID

In AWS, a single namespace is shared by all tenants. RGW provides each tenant with a dedicated namespace for their buckets. In future releases, there might be a choice to activate a 'flat' bucket namespace similar to AWS. Currently, in order to reach a bucket owned by a different tenant, refer to it as "tenant:bucket" when making an S3 request

In AWS, a bucket policy allows giving access to a different account, which can further grant access to specific users by assigning user permissions. As user, role, and group permissions are not yet supported, account owners must currently give access to individual users directly. Granting access to a bucket for an entire account will give access to all users in that account.

String interpolation is not currently supported by bucket policies.

The condition keys we support for all requests are: - aws:CurrentTime - aws:EpochTime - aws:PrincipalType - aws:Referer - aws:SecureTransport - aws:SourceIp - aws:UserAgent - aws:username

We uphold specific s3 condition keys for requests related to buckets and objects.

Functionality for the specified bucket operations has been included.

### Bucket Related Operations

<table data-header-hidden><thead><tr><th width="258"></th><th></th></tr></thead><tbody><tr><td><strong>Permission</strong></td><td><strong>Condition Keys</strong></td></tr><tr><td>s3:createBucket</td><td>s3:x-amz-acl s3:x-amz-grant-&#x3C;perm> where perm is one of read/write/read-acp write-acp/ full-control</td></tr><tr><td><p>s3:ListBucket &#x26;</p><p>s3:ListBucketVersions</p></td><td><p>s3:prefix</p><p></p><p>s3:delimiter</p><p></p><p>s3:max-keys</p></td></tr><tr><td>s3:PutBucketAcl</td><td>s3:x-amz-acl s3:x-amz-grant-&#x3C;perm></td></tr></tbody></table>

### Object Related Operations

<table data-header-hidden><thead><tr><th width="368"></th><th width="253"></th><th></th></tr></thead><tbody><tr><td>Permission</td><td>Condition Keys</td><td>Comments</td></tr><tr><td></td><td><p>s3:x-amz-acl &#x26; s3:x-amz-grant-&#x3C;perm></p><p></p><p>s3:x-amz-copy-source</p></td><td></td></tr><tr><td></td><td>s3:x-amz-server-side-encryption</td><td></td></tr><tr><td>s3:PutObject</td><td>s3:x-amz-server-side-encryption-aws-kms-key-id</td><td></td></tr><tr><td></td><td>s3:x-amz-metadata-directive</td><td>PUT &#x26; COPY to overwrite/preserve metadata in COPY requests</td></tr><tr><td></td><td>s3:RequestObjectTag/&#x3C;tag-key></td><td></td></tr><tr><td><p>s3:PutObjectAcl </p><p>s3:PutObjectVersionAcl</p></td><td><p></p><p>s3:x-amz-acl &#x26; s3-amz-grant-&#x3C;perm></p><p></p><p>s3:ExistingObjectTag/&#x3C;tag-key></p></td><td></td></tr><tr><td>s3:PutObjectTagging &#x26; s3:PutObjectVersionTagging</td><td><p>s3:RequestObjectTag/&#x3C;tag-key></p><p></p><p>s3:ExistingObjectTag/&#x3C;tag-key></p></td><td></td></tr><tr><td><p>s3:GetObject &#x26; </p><p>s3:GetObjectVersion</p></td><td>s3:ExistingObjectTag/&#x3C;tag-key></td><td></td></tr><tr><td><p>s3:GetObjectAcl &#x26; </p><p>s3:GetObjectVersionAcl</p></td><td>s3:ExistingObjectTag/&#x3C;tag-key></td><td></td></tr><tr><td>s3:GetObjectTagging &#x26; s3:GetObjectVersionTagging</td><td>s3:ExistingObjectTag/&#x3C;tag-key></td><td></td></tr><tr><td>s3:DeleteObjectTagging &#x26; s3:DeleteObjectVersionTagging</td><td>s3:ExistingObjectTag/&#x3C;tag-key></td><td></td></tr></tbody></table>

Additional support may be available in the near future as we merge with the recently revamped Authentication/Authorization subsystem.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.zata.ai/manage/bucket/applying-limitations-with-bucket-policies.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.