Skip to content
Documentation
Infrastructure as a Service
Storage
Object Storage
Bucket policies

Object storage bucket policies

A bucket policy is an IAM-style JSON document. Attach it when you create or update a bucket, as the policy field. It decides which Thalassa users and service accounts can call which S3 actions on that bucket.

You can set the same document in the console bucket policy JSON editor.

How access is decided

An empty Statement list means the document adds no extra allow or deny rules.

{
  "Version": "2012-10-17",
  "Statement": []
}

When the document contains statements, access is granted only by a matching Allow. Any matching Deny wins when both match the same principal, action, and resource.

A statement matches when the caller’s principal, the S3 action, and the resource ARN all match that statement.

Policy document

FieldRequiredRules
VersionYesMust be exactly 2012-10-17.
StatementYesArray of statements. May be empty.

Statements 

{
  "Sid": "AllowReadObjects",
  "Effect": "Allow",
  "Principal": {
    "Thalassa": "arn:thalassa:iam:::user/org-identity:user-subject"
  },
  "Action": ["s3:GetObject"],
  "Resource": ["arn:thalassa:s3:::my-bucket/*"]
}
FieldRequiredRules
SidNoUp to 255 characters. Letters, digits, _, and - only.
EffectYesAllow or Deny.
PrincipalYesAt least one of Thalassa or AWS. Each value is a string or an array of strings.
ActionYesOne action string, or an array of action strings. At least one action. Wildcards such as s3:* are rejected.
ResourceYesArray of resource ARNs. At least one. Every ARN must name this bucket.
ConditionNoOptional IAM condition object. It is stored and forwarded to object storage. The platform does not validate condition keys.

List every action by name. The platform rejects action wildcards, including s3:*.

Principals

Use Principal.Thalassa. The organisation identity in the ARN must be the organisation that owns the bucket.

WhoARN
Userarn:thalassa:iam:::user/{organisationIdentity}:{userSubject}
Service accountarn:thalassa:iam:::serviceaccount/{organisationIdentity}:{serviceAccountIdentity}
Any principal*
Any user in the organisationarn:thalassa:iam:::user/{organisationIdentity}:*
Any service account in the organisationarn:thalassa:iam:::serviceaccount/{organisationIdentity}:*

A named user must already be a member of the organisation. A named service account must already exist in the organisation.

Principal.Thalassa accepts one ARN as a string, or several ARNs as an array. The same ARN shapes with an arn:aws:iam::: prefix are accepted and treated as the Thalassa principal.

* matches any principal. Use a named ARN, or an organisation wildcard, when the statement should cover a smaller set of callers.

Resources

Resource ARNs must use this bucket’s name. arn:aws:s3::: is accepted and treated the same as arn:thalassa:s3:::.

TargetARNTypical actions
The bucketarn:thalassa:s3:::my-buckets3:ListBucket, s3:GetBucketVersioning
Every objectarn:thalassa:s3:::my-bucket/*s3:GetObject, s3:PutObject, s3:DeleteObject
One objectarn:thalassa:s3:::my-bucket/folder/file.txtObject actions on that key
A prefixarn:thalassa:s3:::my-bucket/logs/*Object actions under that prefix

Listing a bucket and reading its objects are different resources. Grant both when a caller needs to list and download.

Object keys

Object keys may be at most 1024 bytes. Spaces and Unicode are allowed. Keys must not contain .., //, a leading or trailing /, or control characters.

Actions you can grant

Objects

PurposeActions
Reads3:GetObject, s3:GetObjectVersion
Writes3:PutObject, s3:RestoreObject
Deletes3:DeleteObject, s3:DeleteObjectVersion
ACLs3:GetObjectAcl, s3:GetObjectVersionAcl, s3:PutObjectAcl, s3:PutObjectVersionAcl
Multipart uploads3:ListMultipartUploadParts, s3:AbortMultipartUpload
Taggings3:GetObjectTagging, s3:PutObjectTagging, s3:DeleteObjectTagging, s3:GetObjectVersionTagging, s3:PutObjectVersionTagging, s3:DeleteObjectVersionTagging
Object locks3:GetObjectRetention, s3:PutObjectRetention, s3:GetObjectLegalHold, s3:PutObjectLegalHold, s3:BypassGovernanceRetention

Bucket

PurposeActions
Lists3:ListBucket, s3:ListBucketVersions, s3:ListBucketMultipartUploads, s3:ListAllMyBuckets
Buckets3:CreateBucket, s3:DeleteBucket
ACLs3:GetBucketAcl, s3:PutBucketAcl
CORSs3:GetBucketCORS, s3:PutBucketCORS
Versionings3:GetBucketVersioning, s3:PutBucketVersioning
Request payments3:GetBucketRequestPayment, s3:PutBucketRequestPayment
Lifecycles3:GetLifecycleConfiguration, s3:PutLifecycleConfiguration
Object lock configurations3:GetBucketObjectLockConfiguration, s3:PutBucketObjectLockConfiguration
Policy statuss3:GetBucketPolicyStatus
Public access blocks3:GetPublicAccessBlock, s3:PutPublicAccessBlock, s3:DeletePublicAccessBlock, s3:GetBucketPublicAccessBlock, s3:PutBucketPublicAccessBlock, s3:DeleteBucketPublicAccessBlock

Actions excluded from bucket policies

These actions cannot be set in this document:

  • Bucket policy management: s3:GetBucketPolicy, s3:PutBucketPolicy, s3:DeleteBucketPolicy
  • s3:GetBucketLocation
  • Website, logging, bucket tagging, notification, replication, encryption, accelerate, and torrent actions

Guides

Service account access
Let one application list, read, write, and delete objects
User read access
Grant one user or a team read access, including a key prefix
Deny deletes
Allow writes and block object deletes with an explicit Deny

For endpoints and SDKs, see Clients. For customer-provided encryption keys, see SSE-C.

BucketsService account access