DevTools Logo

S3 Bucket Policy Generator

S3 Bucket Policy Generator

Generate an AWS S3 bucket policy JSON for a principal, actions, and prefix.

Policy inputs

Generated policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}
client-side
JSON

Examples

Public read of objects under a prefix

Input
bucket: my-bucket
principal: *
action: s3:GetObject
prefix: public/
Output
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-bucket/public/*" } ] }

The principal is everyone, the action is scoped to objects under public/, and the resource reflects the prefix.

About this tool

The S3 Bucket Policy Generator writes a bucket policy that grants or denies a set of S3 actions to a principal. Enter the bucket name, choose the effect, set the principal (a 12-digit account id is expanded to its root ARN, or use * or any ARN), pick the actions, and optionally scope them to a key prefix.

You can also include the bucket ARN itself for ListBucket-style access. The output is valid JSON with the standard version and a single statement, ready to paste into the bucket's Permissions tab. Everything runs client-side — nothing is uploaded.

How to use

  1. Set bucket and principal

    Enter the bucket name and the principal (account id, *, or ARN) the policy applies to.

  2. Choose actions and scope

    Pick the S3 actions and optionally narrow them to a key prefix like logs/.

  3. Copy the policy

    Copy the JSON and attach it to the bucket in the AWS console or via Terraform/CloudFormation.

Use cases

Cross-account access

Grant another AWS account read or write access to a bucket or prefix.

Static website public reads

Allow anonymous s3:GetObject on a prefix used for public assets.

Common mistakes

Mistake:Granting ListBucket on object ARNs.

Fix:ListBucket applies to the bucket ARN, not objects — tick the bucket-ARN option for that action.

Mistake:Forgetting the prefix trailing slash.

Fix:Use logs/ (not logs) so the wildcard covers the intended subtree.

Frequently asked questions

Related guides

S3 Bucket Policies: Who Can Do What to Which Objects

How an S3 bucket policy differs from IAM, the Principal/Action/Resource triple, and when to scope by key prefix or include the bucket ARN.

Writing IAM Policies by Hand (Without Shooting Yourself in the Foot)

The anatomy of an AWS IAM policy — Version, Statement, Effect, Action, Resource — and how to keep permissions tight and readable.

References & standards

Related tools

.htaccess Generator

Build an Apache .htaccess — HTTPS redirects, rewrites, error pages, security headers, and basic auth

Ansible Playbook Generator

Build an Ansible playbook — hosts, vars, and tasks with modules — as YAML

Apache Config Generator

Build an Apache 2.4 VirtualHost — ServerName, DocumentRoot, Directory, aliases, and optional SSL

CHANGELOG Generator

Write a clean, consistent CHANGELOG entry in the Keep a Changelog format from grouped Added, Changed, Deprecated, Removed, Fixed, and Security notes

Chmod Calculator

Calculate Linux file permissions (777, 755 etc) easily.

CircleCI Config Generator

Generate a .circleci/config.yml — jobs with Docker images and run steps wired into a workflow