Required permissions for Amazon S3 API operations
Note
This page is about Amazon S3 policy actions for general purpose buckets. To learn more about Amazon S3 policy actions for directory buckets, see Actions for directory buckets.
To perform an S3 API operation, you must have the right permissions. This page maps S3 API operations to the required permissions. To grant permissions to
perform an S3 API operation, you must compose a valid policy (such as an S3 bucket
policy or IAM identity-based policy), and specify corresponding actions in the
Action element of the policy. These actions are called policy actions.
Not every S3 API operation is represented by a single permission (a single policy action), and some permissions (some policy actions) are required for many different API operations.
When you compose policies, you must specify the Resource element based on the correct resource type required by the corresponding Amazon S3 policy actions. This page categorizes permissions to S3 API operations by the resource types.
For more information about the resource types, see
Resource types defined by Amazon S3 in the Service Authorization
Reference. For a full list of Amazon S3 policy actions, resources, and condition keys for use in policies, see
Actions, resources, and condition keys for Amazon S3 in the Service Authorization
Reference. For a complete list of Amazon S3 API operations, see Amazon S3 API Actions in the Amazon Simple Storage Service API Reference.
For more information on how to address the HTTP 403 Forbidden errors in S3, see Troubleshoot access denied (403 Forbidden) errors in Amazon S3. For
more information on the IAM features to use with S3, see How Amazon S3 works with IAM. For more information on S3 security best practices,
see Security best practices for Amazon S3.
Bucket operations and permissions
Bucket operations are S3 API operations that operate on the bucket resource type. You must specify S3 policy actions for bucket operations in bucket policies or IAM identity-based policies.
In the policies, the Resource element must be the bucket Amazon Resource Name (ARN). For more information about the Resource element format and
example policies, see Bucket operations.
Note
To grant permissions to bucket operations in access point policies, note the following:
-
Permissions granted for bucket operations in an access point policy are effective only if the underlying bucket allows the same permissions. When you use an access point, you must delegate access control from the bucket to the access point or add the same permissions in the access point policy to the underlying bucket's policy.
-
In access point policies that grant permissions to bucket operations, the
Resourceelement must be theaccesspointARN. For more information about theResourceelement format and example policies, see Bucket operations in policies for access points for general purpose buckets. For more information about access point policies, see Configuring IAM policies for using access points. Not all bucket operations are supported by access points. For more information, see Access points compatibility with S3 operations.
The following is the mapping of bucket operations and required policy actions.
| API operations | Policy actions | Description of policy actions |
|---|---|---|
|
(Required) |
Required to create a new s3 bucket. |
|
|
(Conditionally required) |
Required if you want to use access control list (ACL) to specify permissions on a bucket when you make a |
|
|
(Conditionally required) |
Required if you want to enable Object Lock when you create a bucket. |
|
|
(Conditionally required) |
Required if you want to specify S3 Object Ownership when you create a bucket. |
|
|
CreateBucketMetadataConfiguration (V2 API operation. The IAM policy action name is the same for the V1 and V2 API operations.) |
(Required) |
Required to create a metadata table configuration on a general purpose bucket. To create your AWS managed table bucket and the metadata tables that are specified in
your metadata table configuration, you must have the specified If you want to encrypt your metadata tables with server-side encryption with AWS Key Management Service (AWS KMS) keys (SSE-KMS), you need additional permissions in your KMS key policy. For more information, see Setting up permissions for configuring metadata tables. If you also want to integrate your AWS managed table bucket with AWS analytics services so that you can query your metadata table, you need additional permissions. For more information, see Integrating Amazon S3 Tables with AWS analytics services. |
|
CreateBucketMetadataTableConfiguration (V1 API operation) |
(Required) |