AWS S3 Bucket Policy Generator

An S3 bucket policy is a resource-based IAM policy attached directly to an S3 bucket. It controls who can access the bucket and what actions they can perform — without needing to configure per-user IAM roles. Use it for public read access, cross-account sharing, CloudFront OAI, and IP-based restrictions.

s3:GetObject allows downloading individual objects. s3:ListBucket allows listing the contents of the bucket. For a public static website you typically need both. They apply to different resources: ListBucket applies to the bucket ARN, GetObject applies to the bucket's objects (arn:aws:s3:::my-bucket/*).

Add a condition with key aws:SourceIp and a list of CIDR blocks as the value. For example: {"aws:SourceIp": ["203.0.113.0/24", "198.51.100.5/32"]}. Use IpAddress to allow those IPs, or NotIpAddress with Effect: Deny to block everything else.

An OAI is a special CloudFront identity that lets you restrict S3 bucket access so objects can only be served through CloudFront, not accessed directly. The policy allows s3:GetObject for the principal arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity <OAI-ID>.

Principal defines who the policy applies to. Use "*" for everyone (public). Use an AWS account ID for cross-account access. Use a specific IAM user, role, or service ARN for scoped access. The format is {"AWS": "arn:aws:iam::account-id:role/role-name"} or {"Service": "cloudfront.amazonaws.com"} for services.

In most S3 bucket policies you use Effect: Allow with your intended principals and actions. Only add explicit Deny statements when you need to override an Allow — for example, to block HTTP (require HTTPS) or deny access from outside a VPC. An explicit Deny always wins over any Allow.