Grant a service account access to a bucket

Use this policy when an application, running as one service account, needs to use a bucket as its object store. The statement allows that service account to list the bucket, read and write objects, delete objects and versions, and read object ACLs.

The service account must already exist in the organisation that owns the bucket. See Service accounts to create one, and Bucket policies for the document rules.

Policy

Replace org-identity and sa-identity with the organisation identity and the service account identity. Replace my-bucket in both resource ARNs with this bucket’s name.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowServiceAccountAccess",
      "Effect": "Allow",
      "Principal": {
        "Thalassa": "arn:thalassa:iam:::serviceaccount/org-identity:sa-identity"
      },
      "Action": [
        "s3:GetObject",
        "s3:GetObjectVersion",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "s3:ListBucket",
        "s3:ListBucketVersions",
        "s3:GetObjectAcl",
        "s3:GetObjectVersionAcl"
      ],
      "Resource": [
        "arn:thalassa:s3:::my-bucket",
        "arn:thalassa:s3:::my-bucket/*"
      ]
    }
  ]
}

s3:ListBucket and s3:ListBucketVersions are checked against the bucket ARN. The object actions are checked against arn:thalassa:s3:::my-bucket/*. Include both resources so listing and object access succeed together.

Version actions (s3:GetObjectVersion, s3:DeleteObjectVersion, s3:ListBucketVersions, and s3:GetObjectVersionAcl) apply when bucket versioning is enabled. This statement allows reading ACLs with s3:GetObjectAcl and s3:GetObjectVersionAcl. Add s3:PutObjectAcl or s3:PutObjectVersionAcl when the service account must change an ACL.

To block deletes while still allowing uploads, add an explicit deny. See Deny deletes.

Attach the policy

Set the document as the bucket’s policy field when you create the bucket or when you update it. In the console, open the bucket and paste the document into the bucket policy JSON editor.

Because the document contains statements, this service account can call an action only when an Allow matches. Callers whose ARN does not match Principal receive no allow from this document.

After you save the policy, list and download an object with the service account’s credentials. Repeat the same calls with a different user or service account and confirm those calls are not allowed by this statement.