Secure AWS S3 Bucket Policies

Writes secure, efficient AWS S3 bucket policies using IAM policy language - covering least-privilege access patterns, cross-account access, CDN integration, condition-based restrictions, and compliance logging.

Use this skill when writing a new S3 bucket policy, granting cross-account or service-principal access to a bucket, restricting access by IP address or time window, setting up a CloudTrail or other logging bucket policy, or troubleshooting an access-denied error on an S3 bucket. Not a fit for IAM user/role policy design unrelated to S3, or for S3 features like lifecycle rules and versioning that fall outside bucket policy access control.

Explains the core policy structure: Version ("2012-10-17"), a Statement array where each statement has Effect (Allow/Deny, with explicit deny always winning), Principal, Action (S3 API operations), Resource (bucket/object ARNs), and optional Condition blocks for fine-grained control.

Provides ready-to-use policy examples for the principle of least privilege (scoped actions and resource paths for a specific IAM user), explicit deny statements enforcing secure transport (aws:SecureTransport), public read access for static website hosting, cross-account access with a server-side-encryption condition, and a CloudFront Origin Access Identity policy scoped to a specific distribution ARN via AWS:SourceArn.

Advanced condition examples cover IP address restriction via aws:SourceIp CIDR ranges and time-based access windows using DateGreaterThan/DateLessThan on aws:CurrentTime. A CloudTrail log bucket policy example shows the two required statements (ACL check and PutObject write) with the bucket-owner-full-control condition.

Policy optimization guidance covers testing with the AWS IAM Policy Simulator, combining statements to reduce policy size, using policy variables like ${aws:username} for dynamic paths, regular permission audits, and monitoring via CloudTrail and Access Analyzer. Troubleshooting guidance covers the access-denied intersection of bucket policy and IAM permissions, the 20KB bucket policy size limit, correct ARN formatting for cross-account principals, and condition logic (AND within a condition block, OR between condition keys). Security guidance warns against "Principal": "*" with Allow and no conditions, and recommends encryption in transit/at rest, MFA for sensitive operations, VPC endpoints, and CloudWatch/GuardDuty monitoring.

Targets AWS S3 IAM-based bucket policies, with example integrations for CloudFront (Origin Access Identity), CloudTrail (log delivery), and cross-account IAM principals.

Cloud/security engineers writing or auditing S3 bucket policies who need concrete, tested JSON policy patterns for common access scenarios rather than a general IAM policy language overview.

{
  "Effect": "Deny",
  "Condition": {"Bool": {"aws:SecureTransport": "false"}}
}