Skip to main content
IAM Policy Map

Policy Builder

Write a custom policy of your own, one statement at a time. Or pick the tasks you need to do and get a recommended set of AWS managed policies that together grant them. Only policies with reviewed guidance are recommended. The result is a recommended set to start from: check the exact actions before you attach anything.

Write a custom policy

Build an identity-based policy one statement at a time and get the JSON to copy or download. Services, actions, resource formats and condition keys come from AWS's public service reference data. Everything you type stays in your browser.

What a statement contains

Effect
Says whether the statement allows or denies the actions it lists.
Action
Lists the service operations the statement covers, such as s3:GetObject.
Resource
Names the resources, by ARN, that the actions apply to; * means all of them.
Condition
Optionally limits the statement to requests that match a key, an operator and a value.

Rules the generator follows

To see which actions a service offers, open it from the services list: each service page lists its actions.

The form needs JavaScript to run.

Recommend managed policies

5 groups, 34 tasks. Each task lists the exact actions it needs.

Amazon S3 access points

Storage. Creating, deleting and managing the policies of access points for general purpose buckets.

Amazon S3 bucket access control

Storage. Reading and changing bucket policies, public access blocks, ACLs and Object Ownership.

  • View a bucket policy and whether it is public

    Return the policy of a bucket and its policy status.

    Read-only task. A reviewed policy fits this task.

    Policies that grant every action of this task on their own:

    Required actions (2)
    • s3:GetBucketPolicy
    • s3:GetBucketPolicyStatus

  • Set or delete a bucket policy

    Apply or delete the policy of a bucket.

    Needs write access. A reviewed policy fits this task.

    Policies that grant every action of this task on their own:

    Required actions (2)
    • s3:DeleteBucketPolicy
    • s3:PutBucketPolicy

  • View bucket-level block public access

    Retrieve the block public access configuration of a bucket.

    Read-only task. A reviewed policy fits this task.

    Policies that grant every action of this task on their own:

    Required actions (1)
    • s3:GetBucketPublicAccessBlock

  • Change bucket-level block public access

    Create, modify or remove the block public access configuration of a bucket.

    Needs write access. A reviewed policy fits this task.

    Policies that grant every action of this task on their own:

    Required actions (1)
    • s3:PutBucketPublicAccessBlock

  • View bucket and object ACLs

    Return the access control list of a bucket or of an object.

    Read-only task. A reviewed policy fits this task.

    Policies that grant every action of this task on their own:

    Required actions (2)
    • s3:GetBucketAcl
    • s3:GetObjectAcl

  • Change bucket and object ACLs

    Set access control list permissions on an existing bucket or object.

    Needs write access. A reviewed policy fits this task.

    Policies that grant every action of this task on their own:

    Required actions (2)
    • s3:PutBucketAcl
    • s3:PutObjectAcl

  • View Object Ownership setting

    Retrieve the Object Ownership setting of a bucket.

    Read-only task. A reviewed policy fits this task.

    Policies that grant every action of this task on their own:

    Required actions (1)
    • s3:GetBucketOwnershipControls

  • Change Object Ownership setting

    Create, modify or remove the Object Ownership setting of a bucket.

    Needs write access. A reviewed policy fits this task.

    Policies that grant every action of this task on their own:

    Required actions (1)
    • s3:PutBucketOwnershipControls

Amazon S3 bucket configuration

Storage. Reading and changing bucket settings such as versioning, lifecycle, encryption, logging, CORS and tags.

  • View bucket configuration

    Read the versioning, lifecycle, default encryption, logging, CORS and tagging settings of a bucket.

    Read-only task. A reviewed policy fits this task.

    Policies that grant every action of this task on their own:

    Required actions (6)
    • s3:GetBucketCORS
    • s3:GetBucketLogging
    • s3:GetBucketTagging
    • s3:GetBucketVersioning
    • s3:GetEncryptionConfiguration
    • s3:GetLifecycleConfiguration

  • Change bucket versioning

    Set the versioning state of a bucket.

    Needs write access. A reviewed policy fits this task.

    Policies that grant every action of this task on their own:

    Required actions (1)
    • s3:PutBucketVersioning

  • Manage lifecycle rules

    Create, replace or delete the S3 Lifecycle configuration of a bucket.

    Needs write access. A reviewed policy fits this task.

    Policies that grant every action of this task on their own:

    Required actions (1)
    • s3:PutLifecycleConfiguration

  • Change default bucket encryption

    Configure or reset the default encryption of a bucket.

    Needs write access. A reviewed policy fits this task.

    Policies that grant every action of this task on their own:

    Required actions (1)
    • s3:PutEncryptionConfiguration

  • Change bucket logging

    Set the logging parameters of a bucket.

    Needs write access. A reviewed policy fits this task.

    Policies that grant every action of this task on their own:

    Required actions (1)
    • s3:PutBucketLogging

  • Manage bucket CORS configuration

    Set or delete the cross-origin resource sharing configuration of a bucket.

    Needs write access. A reviewed policy fits this task.

    Policies that grant every action of this task on their own:

    Required actions (1)
    • s3:PutBucketCORS

  • Manage bucket tags

    Add or delete tags on a bucket.

    Needs write access. A reviewed policy fits this task.

    Policies that grant every action of this task on their own:

    Required actions (1)
    • s3:PutBucketTagging

Amazon S3 bucket creation and deletion

Storage. Creating, finding and deleting general purpose buckets.

Amazon S3 object access

Storage. Listing, reading, writing and deleting objects in general purpose buckets.