How is this different from a template gallery?

A gallery hands you one frozen JSON file to hand-edit. This tool keeps a live model of the policy as a list of statements — you add and remove them, set the effect, principal, actions, resource scope, and conditions on each — and regenerates the JSON on every change. You also get a security audit watching for the mistakes that lock you out or expose the bucket.

What does the security audit check?

It flags public access to s3:* (anyone gets full control), public write actions like PutObject and DeleteObject, a public Allow with no aws:SecureTransport or IP condition, object-level actions such as s3:GetObject scoped to the bucket ARN without the /* resource (so they match nothing), a CloudFront principal missing its AWS:SourceArn condition, and a broad Deny on s3:* that shadows every Allow. Findings are graded danger, warning, or info.

When do I need the /* on the resource?

Object-level actions like s3:GetObject, s3:PutObject, and s3:DeleteObject apply to objects, so their Resource must be arn:aws:s3:::bucket/*. Bucket-level actions like s3:ListBucket apply to the bucket itself (arn:aws:s3:::bucket). The Resource selector lets you choose objects, bucket, or both, and the audit warns when an object action is scoped to the bucket ARN only.

How does the CloudFront OAC statement work?

It grants s3:GetObject to the cloudfront.amazonaws.com service principal and adds a StringEquals condition on AWS:SourceArn pointing at your distribution ARN, so only that distribution can read the bucket. This is the Origin Access Control pattern. Fill in your real distribution ARN — the audit warns if a CloudFront principal has no SourceArn condition, which would let any distribution read the bucket.

Why use a Deny to enforce HTTPS or encryption?

Explicit Deny statements override any Allow, which makes them the right tool for guardrails. The enforce-HTTPS quick-add denies all S3 actions when aws:SecureTransport is false, blocking plaintext HTTP. The require-encryption quick-add denies PutObject unless the request carries the expected server-side-encryption header. Both are standard security baselines for production buckets.

Are the bucket policy and CORS configuration the same thing?

No — they are separate S3 settings. A bucket policy is an IAM document controlling who can perform which actions on the bucket. A CORS configuration controls which web origins browsers may make cross-origin requests from, and which methods are allowed. This tool generates either one via the output toggle; the CORS editor lets you set origins, methods, and the max-age cache value.

AWS S3 Policy Generator

Assemble an IAM bucket policy statement by statement — pick the Effect, the principal (public, an account/role ARN, or a CloudFront OAC service principal), the s3:* actions, the resource scope, and conditions like enforce-HTTPS, restrict-by-IP, or require-encryption. The policy JSON renders live, a matching CORS configuration is one toggle away, and a security audit flags public s3:*, public writes, missing /* on object actions, and unconditioned public access before you ship it.

About this ToolHow it works, benefits & use cases

An S3 bucket policy is a list of IAM statements, and most generators only hand you one fixed template. This tool is a real statement builder: you add statements one at a time and, for each, choose the Effect (Allow or Deny), the Principal (everyone/public, a specific AWS account or role ARN, or the CloudFront OAC service principal), the s3:* actions, the resource scope (the bucket, its objects via /*, or both), and any Conditions — enforce HTTPS via aws:SecureTransport, restrict by IP with aws:SourceIp, lock reads to a CloudFront distribution via AWS:SourceArn, or require encryption on upload. Quick-add buttons drop in ready-made statements (public read, CloudFront OAC, enforce HTTPS, restrict by IP, require encryption, full private), and presets give you a whole policy in one click. The JSON renders live with the canonical 2012-10-17 version, a matching S3 CORS configuration is one toggle away, and a security audit checks your work — flagging public s3:*, public writes, a public Allow with no HTTPS condition, object actions missing the /* resource, and a CloudFront principal with no SourceArn lock.

How to Use

1Start from a preset (Public static website, CloudFront private origin, Locked-down private, Read-only for a role, Enforce TLS + encryption) or build from scratch.
2Set your bucket name — it is interpolated into every Resource ARN.
3Add statements with the quick-add buttons or a blank statement, then set each Effect, Principal, Actions, Resource scope, and Conditions.
4Watch the policy JSON render live and read the security audit for risks and warnings.
5Flip the output toggle to CORS config to generate a matching CORSRules document with your origins, methods, and max-age.
6Copy or download bucket-policy.json (or cors.json), or share the URL to hand a teammate the exact policy.

Key Benefits

A true statement builder — assemble Allow/Deny statements, not a single fixed template
Principals for public access, a specific account/role ARN, or a CloudFront OAC service principal
Actions chosen from a catalog of common s3:* operations, with the right object vs bucket resource
Conditions for enforce-HTTPS, restrict-by-IP, CloudFront SourceArn, and require-encryption
A security audit that flags public s3:*, public writes, unconditioned public Allow, and missing /* on object actions
One-toggle matching S3 CORS configuration with selectable origins, methods, and max-age
Live JSON using the canonical 2012-10-17 version, with a shareable URL for handoff

Common Use Cases

Making a static-website bucket publicly readable with a correctly scoped GetObject statement
Locking a CloudFront-fronted bucket so only your distribution can read objects (OAC pattern)
Adding an enforce-HTTPS Deny so requests over plain HTTP are rejected
Granting a specific IAM role read and list access without opening the bucket publicly
Auditing a draft policy for public writes, missing /* resources, or unconditioned public access before applying it
Generating a matching CORS configuration so browsers can fetch from or upload to the bucket

bucket-policy.json

1 statement · my-website-bucket

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-website-bucket/*"
    }
  ]
}

1 warning

PublicReadGetObject: public Allow with no aws:SecureTransport / IP condition. Add an "enforce HTTPS" Deny or restrict by IP.

Start from a preset

Bucket

Bucket name

Interpolated into every Resource ARN (arn:aws:s3:::bucket).

Add a statement

Statements

Effect

Resource

Principal

Anonymous access — anyone on the internet

Actions

Conditions

Require HTTPS (aws:SecureTransport)

Use on a Deny to block plaintext HTTP

Restrict by IP (aws:SourceIp)

CIDR list, comma-separated

CloudFront distribution (AWS:SourceArn)

Distribution ARN that may read

Require encryption on upload

s3:x-amz-server-side-encryption

Require canned ACL (s3:x-amz-acl)

e.g. bucket-owner-full-control

A statement builder, not a template picker

An S3 bucket policy is a list of IAM statements. This tool lets you assemble them one at a time — choosing the Effect, the Principal, the Actions, the Resource scope, and any Conditions — and emits the JSON live. A misplaced Effect or a missing /* can lock you out or leave a bucket wide open, so the audit panel checks your work as you go.

What the audit catches

Public access to s3:* or public write (PutObject/DeleteObject).
A public Allow with no HTTPS / IP condition.
Object-level actions (s3:GetObject) without the /* resource.
A CloudFront principal missing its AWS:SourceArn condition.
A broad Deny s3:* that shadows every Allow.

Was this tool helpful?

Share Your Experience

Help others discover this tool!

Share on

AWS S3 Policy Generator

How to Use

Key Benefits

Common Use Cases

Start from a preset

Bucket

Add a statement

Statements

A statement builder, not a template picker

What the audit catches

Was this tool helpful?

Share Your Experience

Related tools

Frequently Asked Questions - AWS S3 Policy Generator