Bucket Policy

A bucket policy is a set of access rules in JSON format. Use it to make some objects public, restrict access by IP address or forbid deleting objects.

The examples use AWS CLI configured for UzCloud. Replace my-bucket with the name of your bucket.

In the console, you can set a policy in the Bucket Policy field when you create a bucket. With AWS CLI, save the policy to a file and apply it:

aws s3api put-bucket-policy --bucket my-bucket --policy file://policy.json
aws s3api get-bucket-policy --bucket my-bucket
aws s3api delete-bucket-policy --bucket my-bucket   # remove the policy

Public Read for a Folder

Anyone can download objects with the public/ prefix; the rest of the bucket stays private:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadForPublicFolder",
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::my-bucket/public/*"]
    }
  ]
}

The objects are then available at https://s3.uzcstorage.uz/my-bucket/public/<file>.

Access Only from Your IP Addresses

Deny all requests except those from the specified addresses:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyOutsideOffice",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": ["arn:aws:s3:::my-bucket", "arn:aws:s3:::my-bucket/*"],
      "Condition": {
        "NotIpAddress": { "aws:SourceIp": ["203.0.113.0/24"] }
      }
    }
  ]
}

Forbid Deleting Objects

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyDelete",
      "Effect": "Deny",
      "Principal": "*",
      "Action": ["s3:DeleteObject", "s3:DeleteObjectVersion"],
      "Resource": ["arn:aws:s3:::my-bucket/*"]
    }
  ]
}

For reliable protection of backups, use Object Lock: unlike a policy, it cannot be removed by anyone who has your keys.