DevOps

S3 Bucket IAM Policy Generator

Generate secure, least-privilege IAM JSON policies for Amazon S3 bucket access — read-only, read/write, upload-only, and cross-account patterns.

Quick Policy Templates
#1
arn:aws:s3:::my-bucket/*

Least Privilege Verified

Policy statements are explicitly scoped to designated AWS actions and Resource ARNs.

Generated IAM Policy JSON
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3Access",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

S3 Bucket IAM Policy Generator: Complete Guide

S3 Read-Only vs. Read/Write IAM Policy Patterns

The most common S3 IAM policies grant either read-only or read/write access. Read-only requires s3:GetObject and s3:ListBucket. Read/write adds s3:PutObject and s3:DeleteObject. Always scope both the bucket ARN and object path ARN explicitly.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3ReadWrite",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    }
  ]
}

IAM Policy Generators for Other AWS Services

Lambda IAM Policy GeneratorDynamoDB IAM Policy GeneratorEC2 IAM Policy GeneratorAll Services →

How to Use

  1. 1

    Service Pre-Selected

    This page has pre-configured the generator for S3 Bucket. Adjust actions and Resource ARNs as needed.

  2. 2

    Select Allowed Actions

    Click the action tags to toggle specific API permissions on or off. Add custom actions if needed.

  3. 3

    Specify Resource ARNs

    Enter exact Amazon Resource Names to enforce the Principle of Least Privilege.

  4. 4

    Verify & Copy

    Check the real-time security audit badge for wildcard warnings, then copy the formatted JSON policy.

Frequently Asked Questions

What IAM actions do I need for S3 read-only access?+

For read-only S3 access, you need 's3:GetObject' on the object path ARN (arn:aws:s3:::bucket-name/*) and 's3:ListBucket' on the bucket root ARN (arn:aws:s3:::bucket-name). ListBucket is required to enumerate objects in the bucket.

What is the difference between S3 bucket policies and IAM policies?+

IAM policies are attached to users, roles, or groups and define what AWS actions they can perform. S3 bucket policies are attached to the bucket itself and define who can access it. For internal application access, IAM policies are preferred. For cross-account or public access, bucket policies are necessary.

Why do I need two Resource ARNs for S3 IAM policies?+

S3 bucket-level operations (like s3:ListBucket) require the bucket ARN (arn:aws:s3:::bucket-name), while object-level operations (like s3:GetObject, s3:PutObject) require the object path ARN (arn:aws:s3:::bucket-name/*). Omitting either will cause Access Denied errors.