S3 Policy Generator
Generate an S3 bucket policy JSON document with selectable actions, resources, and effect.
Select an effect, the S3 actions to allow or deny, and the bucket/object ARN - this tool generates valid bucket policy JSON.
Always test a new bucket policy in a non-production bucket first, and use the IAM Policy JSON Validator to double-check the syntax before applying it.
What Is an S3 Bucket Policy?
An S3 bucket policy is a JSON document attached directly to a bucket that controls who can perform which actions (like s3:GetObject or s3:PutObject) on the bucket or its objects - separate from IAM policies attached to users/roles.
Why Use This Tool?
Bucket policy JSON has a specific structure (Version, Statement array, each with Effect/Principal/Action/Resource), and a small typo can silently make a policy ineffective or overly permissive. This tool generates syntactically correct policy JSON from simple selections.
How to Use It
- Choose Allow or Deny.
- Select the S3 actions this statement applies to.
- Enter the bucket name (the Resource ARN is built automatically).
- Copy the generated policy JSON into the bucket's permissions settings.
Important Notes
A policy allowing s3:* or a Principal of * grants very broad access - this tool warns when your selections would create an unusually permissive statement, but the responsibility for reviewing final access scope is yours.