S3

Prefix s3, 180 actions · Domain Storage

162 AWS managed policies. 12 have reviewed guidance; the rest have authoritative permission data pending editorial review. 21 are service-linked role policies, shown with permission data only.

User access (27)

AdministratorAccess-AWSElasticBeanstalkAdmin
AmazonAppFlowFullAccessAdmin
AmazonDataZoneProjectRolePermissionsBoundaryAdmin
AmazonDynamoDBFullAccesswithDataPipelineHigh privilegeAdmin
AmazonElasticMapReduceFullAccessHigh privilegeAdmin
AmazonElasticTranscoder_ReadOnlyAccessReader
AmazonLookoutVisionConsoleFullAccessAdmin
AmazonLookoutVisionConsoleReadOnlyAccessReader
AmazonS3FullAccessHigh privilegeAdmin
AmazonS3ReadOnlyAccessReader
AmazonSecurityLakeAdministratorAdmin
AWSAgentlessDiscoveryServiceAdmin
AWSCodePipeline_ReadOnlyAccessReader
AWSDataPipeline_FullAccessAdmin
AWSDataPipeline_PowerUserAdmin
AWSElementalMediaConvertReadOnlyReader
AWSLambdaFullAccessHigh privilegeAdmin
AWSMigrationHubOrchestratorConsoleFullAccessAdmin
AWSMigrationHubOrchestratorInstanceRolePolicyReader
AWSMigrationHubStrategyConsoleFullAccessAdmin
AWSQuickSetupPatchPolicyBaselineAccessReader
ConsoleViewOnlyAccessFromVercelReader
DatabaseAdministratorHigh privilegeAdmin
DataScientistHigh privilegeAdmin
GroundTruthSyntheticConsoleFullAccessReader
GroundTruthSyntheticConsoleReadOnlyAccessReader
TranslateFullAccessAdmin

Operator and limited (65)

AmazonBedrockStudioPermissionsBoundaryOperator
AmazonBraketJobsExecutionPolicyOperator
AmazonCloudWatchEvidentlyFullAccessOperator
AmazonDataZoneProjectDeploymentPermissionsBoundaryHigh privilegeOperator
AmazonDataZoneSageMakerManageAccessRolePolicyOperator
AmazonElasticTranscoder_JobsSubmitterOperator
AmazonRDSCustomInstanceProfileRolePolicyOperator
AmazonRedshiftAllCommandsFullAccessOperator
AmazonRekognitionCustomLabelsFullAccessOperator
AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicyOperator
AmazonSageMakerCanvasBedrockAccessOperator
AmazonSageMakerCanvasDataPrepFullAccessOperator
AmazonSageMakerCanvasEMRServerlessExecutionRolePolicyOperator
AmazonSageMakerClusterInstanceRolePolicyOperator
AmazonSageMakerFeatureStoreAccessOperator
AmazonSageMakerGroundTruthExecutionOperator
AmazonSageMakerHyperPodInferenceAccessOperator
AmazonSageMakerModelGovernanceUseAccessOperator
AmazonSageMakerTrainingSessionAccessOperator
AmazonSageMakerTrainingSessionFullAccessOperator
AmazonSecurityLakePermissionsBoundaryHigh privilegeOperator
AmazonWorkSpacesPoolServiceAccessOperator
AWS-SSM-Automation-DiagnosisBucketPolicyOperator
AWS-SSM-DiagnosisAutomation-AdministrationRolePolicyOperator
AWS-SSM-RemediationAutomation-AdministrationRolePolicyOperator
AWSBackupAccessPointOperatorAccessOperator
AWSBackupServiceRolePolicyForItemRestoresOperator
AWSBackupServiceRolePolicyForS3BackupOperator
AWSBackupServiceRolePolicyForS3RestoreOperator
AWSCodeDeployRoleForECSOperator
AWSCodeDeployRoleForECSLimitedOperator
AWSConnectorOperator
AWSDataExchangeSubscriberFullAccessOperator
AWSDeepLensLambdaFunctionAccessPolicyOperator
AWSDeepRacerFullAccessOperator
AWSDiscoveryContinuousExportFirehosePolicyOperator
AWSElasticBeanstalkCustomPlatformforEC2RoleOperator
AWSElasticBeanstalkEKSImageBuildOperator
AWSElasticBeanstalkEKSObservabilityOperator
AWSElasticBeanstalkWebTierOperator
AWSElasticBeanstalkWorkerTierOperator
AWSForWordPressPluginPolicyOperator
AWSIoTDeviceTesterForFreeRTOSFullAccessOperator
AWSMigrationHubOrchestratorPluginOperator
AWSMigrationHubStrategyCollectorOperator
AWSMobileHub_FullAccessOperator
AWSQuickSetupPatchPolicyDeploymentRolePolicyOperator
AWSQuickSetupPatchPolicyPermissionsBoundaryOperator
AWSQuickSetupSSMDeploymentS3BucketRolePolicyOperator
AWSQuickSetupSSMManageResourcesExecutionPolicyOperator
AWSRefactoringToolkitSidecarPolicyOperator
AWSResilienceHubAsssessmentExecutionPolicyOperator
AWSSystemsManagerEnableConfigRecordingExecutionPolicyOperator
AWSThinkboxAssetServerPolicyOperator
AWSThinkboxAWSPortalAdminPolicyOperator
AWSThinkboxAWSPortalGatewayPolicyOperator
AWSThinkboxAWSPortalWorkerPolicyOperator
AWSTransformLandingZoneAgentPolicyOperator
AWSTransformSecurityAgentExecutorAccessOperator
ConsoleFullAccessFromVercelHigh privilegeOperator
DBModProvisioningAndMigrationOperator
DBModVirtualSourceOperator
GameLiftContainerFleetPolicyOperator
SageMakerStudioAdminProjectUserRolePolicyOperator
ServerMigrationConnectorOperator

Service roles (49)

AmazonAppStreamServiceAccessOperator
AmazonDataZoneGlueManageAccessRolePolicyOperator
AmazonDMSRedshiftS3RoleOperator
AmazonEC2RoleforAWSCodeDeployReader
AmazonEC2RoleforAWSCodeDeployLimitedReader
AmazonEC2RoleforDataPipelineRoleHigh privilegeAdmin
AmazonEC2RoleforSSMHigh privilegeOperator
AmazonElasticMapReduceforEC2RoleHigh privilegeAdmin
AmazonElasticMapReduceRoleHigh privilegeOperator
AmazonElasticTranscoderRoleHigh privilegeOperator
AmazonFreeRTOSOTAUpdateOperator
AmazonGrafanaAthenaAccessOperator
AmazonMachineLearningRoleforRedshiftDataSourceV3Operator
AmazonMacieServiceRoleReader
AmazonSageMakerCanvasForecastAccessOperator
AmazonSageMakerEdgeDeviceFleetPolicyOperator
AmazonSageMakerGeospatialExecutionRoleOperator
AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicyOperator
AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicyOperator
AmazonSecurityLakeMetastoreManagerOperator
AWSCodeDeployRoleForLambdaOperator
AWSCodeDeployRoleForLambdaLimitedOperator
AWSCodeStarServiceRoleAdmin
AWSCostAndUsageReportAutomationPolicyOperator
AWSElasticBeanstalkRoleCoreOperator
AWSElasticBeanstalkServiceHigh privilegeAdmin
AWSGlueServiceNotebookRoleOperator
AWSIoTRuleActionsHigh privilegeOperator
AWSPanoramaApplianceServiceRolePolicyOperator
AWSPanoramaGreengrassGroupRolePolicyAdmin
AWSPanoramaSageMakerRolePolicyOperator
AWSPanoramaServiceRolePolicyOperator
AWSQuicksightAthenaAccessOperator
AWSQuickSightSageMakerPolicyOperator
AWSTransformApplicationDeploymentPolicyOperator
ComprehendDataAccessRolePolicyOperator
GreengrassOTAUpdateArtifactAccessReader
QuickSightAccessForS3StorageManagementAnalyticsReadOnlyReader
ROSAImageRegistryOperatorPolicyOperator
SageMakerStudioBedrockAgentServiceRolePolicyOperator
SageMakerStudioBedrockChatAgentUserRolePolicyOperator
SageMakerStudioBedrockEvaluationJobServiceRolePolicyOperator
SageMakerStudioBedrockKnowledgeBaseServiceRolePolicyOperator
SageMakerStudioBedrockPromptUserRolePolicyOperator
SageMakerStudioDataAppsAccessRolePolicyOperator
SageMakerStudioEMRInstanceRolePolicyOperator
SageMakerStudioQueryExecutionRolePolicyOperator
ServerMigration_ServiceRoleOperator
ServerMigrationServiceRoleForInstanceValidationOperator

Service-linked roles (21)

AccessAnalyzerServiceRolePolicyReader
AmazonBraketServiceRolePolicyOperator
AmazonDevOpsGuruServiceRolePolicyOperator
AmazonGuardDutyServiceRolePolicyOperator
AmazonMacieServiceRolePolicyOperator
ApplicationDiscoveryServiceContinuousExportServiceRolePolicyOperator
AWSAppFabricServiceRolePolicyOperator
AWSContinuumCollectorServiceRolePolicyOperator
AWSDMSServerlessServiceRolePolicyOperator
AWSLicenseManagerMasterAccountRolePolicyOperator
AWSManagedServices_ContactsServiceRolePolicyReader
AWSManagedServices_DetectiveControlsConfig_ServiceRolePolicyOperator
AWSManagedServicesDeploymentToolkitPolicyOperator
AWSMigrationHubStrategyServiceRolePolicyOperator
AWSServiceRoleForSMSOperator
ConfigConformsServiceRolePolicyOperator
IVSRecordToS3Operator
LakeFormationDataAccessServiceRolePolicyReader
LightsailExportAccessOperator
Route53ResolverServiceRolePolicyOperator
SecurityLakeResourceManagementServiceRolePolicyOperator

Also grants S3 actions (167)

abortmultipartupload allowvendedlogdeliveryforresource associateaccessgrantsidentitycenter bypassgovernanceretention createaccessgrant createaccessgrantsinstance createaccessgrantslocation createaccesspoint createaccesspointforobjectlambda createbucket createbucketmetadatatableconfiguration createjob createmultiregionaccesspoint createstoragelensgroup deleteaccessgrant deleteaccessgrantsinstance deleteaccessgrantsinstanceresourcepolicy deleteaccessgrantslocation deleteaccesspoint deleteaccesspointforobjectlambda deleteaccesspointpolicy deleteaccesspointpolicyforobjectlambda deletebucket deletebucketmetadatatableconfiguration deletebucketpolicy deletebucketwebsite deletejobtagging deletemultiregionaccesspoint deleteobject deleteobjectannotation deleteobjecttagging deleteobjectversion deleteobjectversionannotation deleteobjectversiontagging deletestoragelensconfiguration deletestoragelensconfigurationtagging deletestoragelensgroup describejob describemultiregionaccesspointoperation dissociateaccessgrantsidentitycenter getaccelerateconfiguration getaccessgrant getaccessgrantsinstance getaccessgrantsinstanceforprefix getaccessgrantsinstanceresourcepolicy getaccessgrantslocation getaccesspoint getaccesspointconfigurationforobjectlambda getaccesspointforobjectlambda getaccesspointpolicy getaccesspointpolicyforobjectlambda getaccesspointpolicystatus getaccesspointpolicystatusforobjectlambda getaccountpublicaccessblock getanalyticsconfiguration getbucketabac getbucketacl getbucketcors getbucketlocation getbucketlogging getbucketmetadatatableconfiguration getbucketnotification getbucketobjectlockconfiguration getbucketownershipcontrols getbucketpolicy getbucketpolicystatus getbucketpublicaccessblock getbucketrequestpayment getbuckettagging getbucketversioning getbucketwebsite getdataaccess getencryptionconfiguration getintelligenttieringconfiguration getinventoryconfiguration getjobtagging getlifecycleconfiguration getmetricsconfiguration getmultiregionaccesspoint getmultiregionaccesspointpolicy getmultiregionaccesspointpolicystatus getmultiregionaccesspointroutes getobject getobjectacl getobjectannotation getobjectattributes getobjectlegalhold getobjectretention getobjecttagging getobjecttorrent getobjectversion getobjectversionacl getobjectversionannotation getobjectversionannotationforreplication getobjectversionattributes getobjectversionforreplication getobjectversiontagging getobjectversiontorrent getreplicationconfiguration getstoragelensconfiguration getstoragelensconfigurationtagging getstoragelensdashboard getstoragelensgroup initiatereplication listaccessgrants listaccessgrantsinstances listaccessgrantslocations listaccesspoints listaccesspointsforobjectlambda listallmybuckets listbucket listbucketmultipartuploads listbucketversions listcalleraccessgrants listjobs listmultiregionaccesspoints listmultipartuploadparts listobjectannotations listobjectversionannotations liststoragelensconfigurations liststoragelensgroups listtagsforresource objectowneroverridetobucketowner pausereplication putaccelerateconfiguration putaccessgrantsinstanceresourcepolicy putaccesspointconfigurationforobjectlambda putaccesspointpolicy putaccesspointpolicyforobjectlambda putaccesspointpublicaccessblock putaccountpublicaccessblock putanalyticsconfiguration putbucketabac putbucketacl putbucketcors putbucketlogging putbucketnotification putbucketobjectlockconfiguration putbucketownershipcontrols putbucketpolicy putbucketpublicaccessblock putbucketrequestpayment putbuckettagging putbucketversioning putbucketwebsite putencryptionconfiguration putintelligenttieringconfiguration putinventoryconfiguration putjobtagging putlifecycleconfiguration putmetricsconfiguration putmultiregionaccesspointpolicy putobject putobjectacl putobjectannotation putobjectlegalhold putobjectretention putobjecttagging putobjectversionacl putobjectversionannotation putobjectversiontagging putreplicationconfiguration putstoragelensconfiguration putstoragelensconfigurationtagging replicatedelete replicateobject replicateobjectannotation replicatetags restoreobject submitmultiregionaccesspointroutes tagresource untagresource updateaccessgrantslocation updatebucketmetadataannotationtableconfiguration updatebucketmetadatainventorytableconfiguration updatebucketmetadatajournaltableconfiguration updatejobpriority updatejobstatus updateobjectencryption updatestoragelensgroup

Actions (180)

S3 actions that managed policies grant
Action	Access level	Policies granting without limits	Policies granting with resource or condition limits
s3:AbortMultipartUpload	Write	17	39
s3:AllowVendedLogDeliveryForResource	Read	12	4
s3:AssociateAccessGrantsIdentityCenter	Permissions management	12	4
s3:BypassGovernanceRetention	Permissions management	12	3
s3:CreateAccessGrant	Permissions management	12	6
s3:CreateAccessGrantsInstance	Permissions management	12	6
s3:CreateAccessGrantsLocation	Permissions management	12	6
s3:CreateAccessPoint	Write	12	4
s3:CreateAccessPointForObjectLambda	Write	12	3
s3:CreateBucket	Write	18	73
s3:CreateBucketMetadataTableConfiguration	Write	13	3
s3:CreateJob	Write	12	3
s3:CreateMultiRegionAccessPoint	Write	12	3
s3:CreateStorageLensGroup	Write	12	3
s3:DeleteAccessGrant	Permissions management	12	8
s3:DeleteAccessGrantsInstance	Permissions management	12	5
s3:DeleteAccessGrantsInstanceResourcePolicy	Permissions management	12	5
s3:DeleteAccessGrantsLocation	Permissions management	12	8
s3:DeleteAccessPoint	Write	12	6
s3:DeleteAccessPointForObjectLambda	Write	12	5
s3:DeleteAccessPointPolicy	Permissions management	12	5
s3:DeleteAccessPointPolicyForObjectLambda	Permissions management	12	5
s3:DeleteBucket	Write	13	32
s3:DeleteBucketMetadataTableConfiguration	Write	13	5
s3:DeleteBucketPolicy	Permissions management	14	16
s3:DeleteBucketWebsite	Write	14	5
s3:DeleteJobTagging	Tagging	13	5
s3:DeleteMultiRegionAccessPoint	Write	12	5
s3:DeleteObject	Write	17	69
s3:DeleteObjectAnnotation	Write	13	6
s3:DeleteObjectTagging	Tagging	15	7
s3:DeleteObjectVersion	Write	14	23
s3:DeleteObjectVersionAnnotation	Write	13	6
s3:DeleteObjectVersionTagging	Tagging	14	7
s3:DeleteStorageLensConfiguration	Write	12	5
s3:DeleteStorageLensConfigurationTagging	Tagging	13	5
s3:DeleteStorageLensGroup	Write	12	5
s3:DescribeJob	Read	18	3
s3:DescribeMultiRegionAccessPointOperation	Read	16	3
s3:DissociateAccessGrantsIdentityCenter	Permissions management	12	3
s3:GetAccelerateConfiguration	Read	30	15
s3:GetAccessGrant	Read	27	15
s3:GetAccessGrantsInstance	Read	30	14
s3:GetAccessGrantsInstanceForPrefix	Read	23	12
s3:GetAccessGrantsInstanceResourcePolicy	Read	22	13
s3:GetAccessGrantsLocation	Read	27	17
s3:GetAccessPoint	Read	30	16
s3:GetAccessPointConfigurationForObjectLambda	Read	26	14
s3:GetAccessPointForObjectLambda	Read	29	14
s3:GetAccessPointPolicy	Read	30	15
s3:GetAccessPointPolicyForObjectLambda	Read	28	13
s3:GetAccessPointPolicyStatus	Read	27	13
s3:GetAccessPointPolicyStatusForObjectLambda	Read	29	14
s3:GetAccountPublicAccessBlock	Read	33	15
s3:GetAnalyticsConfiguration	Read	30	15
s3:GetBucketAbac	Read	29	19
s3:GetBucketAcl	Read	44	46
s3:GetBucketCORS	Read	33	27
s3:GetBucketLocation	Read	78	83
s3:GetBucketLogging	Read	35	24
s3:GetBucketMetadataTableConfiguration	Read	29	19
s3:GetBucketNotification	Read	33	22
s3:GetBucketObjectLockConfiguration	Read	31	21
s3:GetBucketOwnershipControls	Read	31	21
s3:GetBucketPolicy	Read	41	48
s3:GetBucketPolicyStatus	Read	32	21
s3:GetBucketPublicAccessBlock	Read	38	25
s3:GetBucketRequestPayment	Read	28	17
s3:GetBucketTagging	Read	37	29
s3:GetBucketVersioning	Read	37	31
s3:GetBucketWebsite	Read	36	19
s3:GetDataAccess	Read	24	12
s3:GetEncryptionConfiguration	Read	37	25
s3:GetIntelligentTieringConfiguration	Read	29	16
s3:GetInventoryConfiguration	Read	29	17
s3:GetJobTagging	Read	22	13
s3:GetLifecycleConfiguration	Read	36	22
s3:GetMetricsConfiguration	Read	28	15
s3:GetMultiRegionAccessPoint	Read	30	15
s3:GetMultiRegionAccessPointPolicy	Read	30	14
s3:GetMultiRegionAccessPointPolicyStatus	Read	30	14
s3:GetMultiRegionAccessPointRoutes	Read	22	15
s3:GetObject	Read	30	181
s3:GetObjectAcl	Read	27	28
s3:GetObjectAnnotation	Read	22	17
s3:GetObjectAttributes	Read	22	23
s3:GetObjectLegalHold	Read	24	18
s3:GetObjectRetention	Read	24	18
s3:GetObjectTagging	Read	25	21
s3:GetObjectTorrent	Read	20	17
s3:GetObjectVersion	Read	23	59
s3:GetObjectVersionAcl	Read	21	24
s3:GetObjectVersionAnnotation	Read	20	17
s3:GetObjectVersionAnnotationForReplication	Read	20	17
s3:GetObjectVersionAttributes	Read	20	19
s3:GetObjectVersionForReplication	Read	20	18
s3:GetObjectVersionTagging	Read	21	19
s3:GetObjectVersionTorrent	Read	20	18
s3:GetReplicationConfiguration	Read	35	19
s3:GetStorageLensConfiguration	Read	29	16
s3:GetStorageLensConfigurationTagging	Read	27	15
s3:GetStorageLensDashboard	Read	20	13
s3:GetStorageLensGroup	Read	27	15
s3:InitiateReplication	Write	12	3
s3:ListAccessGrants	List	32	12
s3:ListAccessGrantsInstances	List	31	11
s3:ListAccessGrantsLocations	List	30	12
s3:ListAccessPoints	List	34	11
s3:ListAccessPointsForObjectLambda	List	32	11
s3:ListAllMyBuckets	List	131	38
s3:ListBucket	List	86	132
s3:ListBucketMultipartUploads	List	32	27
s3:ListBucketVersions	List	34	26
s3:ListCallerAccessGrants	List	28	10
s3:ListJobs	List	29	10
s3:ListMultiRegionAccessPoints	List	34	14
s3:ListMultipartUploadParts	List	31	30
s3:ListObjectAnnotations	List	27	10
s3:ListObjectVersionAnnotations	List	25	10
s3:ListStorageLensConfigurations	List	33	12
s3:ListStorageLensGroups	List	30	12
s3:ListTagsForResource	List	32	14
s3:ObjectOwnerOverrideToBucketOwner	Permissions management	12	3
s3:PauseReplication	Write	12	3
s3:PutAccelerateConfiguration	Write	16	8
s3:PutAccessGrantsInstanceResourcePolicy	Permissions management	13	9
s3:PutAccessPointConfigurationForObjectLambda	Write	13	8
s3:PutAccessPointPolicy	Permissions management	13	9
s3:PutAccessPointPolicyForObjectLambda	Permissions management	13	8
s3:PutAccessPointPublicAccessBlock	Permissions management	13	8
s3:PutAccountPublicAccessBlock	Permissions management	13	8
s3:PutAnalyticsConfiguration	Write	14	8
s3:PutBucketAbac	Write	14	8
s3:PutBucketAcl	Permissions management	15	14
s3:PutBucketCORS	Write	17	18
s3:PutBucketLogging	Write	15	14
s3:PutBucketNotification	Write	16	13
s3:PutBucketObjectLockConfiguration	Write	14	10
s3:PutBucketOwnershipControls	Permissions management	14	10
s3:PutBucketPolicy	Permissions management	15	46
s3:PutBucketPublicAccessBlock	Permissions management	14	28
s3:PutBucketRequestPayment	Write	14	8
s3:PutBucketTagging	Tagging	18	25
s3:PutBucketVersioning	Write	16	29
s3:PutBucketWebsite	Write	16	8
s3:PutEncryptionConfiguration	Write	14	29
s3:PutIntelligentTieringConfiguration	Write	14	8
s3:PutInventoryConfiguration	Write	14	9
s3:PutJobTagging	Tagging	14	8
s3:PutLifecycleConfiguration	Write	16	25
s3:PutMetricsConfiguration	Write	13	8
s3:PutMultiRegionAccessPointPolicy	Permissions management	13	8
s3:PutObject	Write	21	139
s3:PutObjectAcl	Permissions management	17	30
s3:PutObjectAnnotation	Write	15	10
s3:PutObjectLegalHold	Write	15	10
s3:PutObjectRetention	Write	15	15
s3:PutObjectTagging	Tagging	16	17
s3:PutObjectVersionAcl	Permissions management	14	14
s3:PutObjectVersionAnnotation	Write	14	10
s3:PutObjectVersionTagging	Tagging	15	10
s3:PutReplicationConfiguration	Write	15	9
s3:PutStorageLensConfiguration	Write	13	8
s3:PutStorageLensConfigurationTagging	Tagging	14	8
s3:ReplicateDelete	Write	14	3
s3:ReplicateObject	Write	14	9
s3:ReplicateObjectAnnotation	Write	14	3
s3:ReplicateTags	Tagging	14	3
s3:RestoreObject	Write	15	10
s3:SubmitMultiRegionAccessPointRoutes	Write	12	3
s3:TagResource	Tagging	14	6
s3:UntagResource	Tagging	14	3
s3:UpdateAccessGrantsLocation	Permissions management	12	3
s3:UpdateBucketMetadataAnnotationTableConfiguration	Write	12	3
s3:UpdateBucketMetadataInventoryTableConfiguration	Write	12	3
s3:UpdateBucketMetadataJournalTableConfiguration	Write	12	3
s3:UpdateJobPriority	Write	12	3
s3:UpdateJobStatus	Write	12	3
s3:UpdateObjectEncryption	Write	12	3
s3:UpdateStorageLensGroup	Write	12	3