Grant users read access to a bucket

These policies grant read access to users who are already members of the organisation that owns the bucket. Each user ARN uses that organisation’s identity. See Bucket policies for principal and resource rules.

Listing uses the bucket ARN. Downloading uses an object ARN. A caller who needs to list and download needs both.

Set the document as the bucket’s policy field on create or update, or paste it into the console bucket policy JSON editor.

One user

s3:ListBucket applies to the bucket. s3:GetObject applies to every object.

Replace org-identity, user-subject, and my-bucket.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowUserRead",
      "Effect": "Allow",
      "Principal": {
        "Thalassa": "arn:thalassa:iam:::user/org-identity:user-subject"
      },
      "Action": ["s3:ListBucket", "s3:GetObject"],
      "Resource": [
        "arn:thalassa:s3:::my-bucket",
        "arn:thalassa:s3:::my-bucket/*"
      ]
    }
  ]
}

Several users, one prefix

Principal.Thalassa can be an array. This statement lets two users list the bucket and download objects under reports/.

s3:GetObject matches arn:thalassa:s3:::my-bucket/reports/*. Keys outside that prefix have no GetObject allow in this statement. s3:ListBucket matches the bucket ARN.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowTeamRead",
      "Effect": "Allow",
      "Principal": {
        "Thalassa": [
          "arn:thalassa:iam:::user/org-identity:user-subject-1",
          "arn:thalassa:iam:::user/org-identity:user-subject-2"
        ]
      },
      "Action": ["s3:ListBucket", "s3:GetObject"],
      "Resource": [
        "arn:thalassa:s3:::my-bucket",
        "arn:thalassa:s3:::my-bucket/reports/*"
      ]
    }
  ]
}

Replace both user subjects and the bucket name. Add further user ARNs to the Thalassa array when more members need the same access.

To grant every user in the organisation, use arn:thalassa:iam:::user/{organisationIdentity}:* as the principal. The organisation identity must still be the organisation that owns the bucket.