Using the ARN in policy statements

In policy statements, the ARN is used in Principal and Resource elements.

Use this syntax to specify the S3 resource ARN:

arn:aws:s3:::bucket-name
arn:aws:s3:::bucket-name/object_key

Use this syntax to specify the identity resource ARN (users and groups):

arn:aws:iam::account_id:root
arn:aws:iam::account_id:user/user_name
arn:aws:iam::account_id:group/group_name
arn:aws:iam::account_id:federated-user/user_name
arn:aws:iam::account_id:federated-group/group_name

Other considerations:

You can use the asterisk (*) as a wildcard to match zero or more characters inside the object key.
International characters, which can be specified in the object key, should be encoded using JSON UTF-8 or using JSON \u escape sequences. Percent-encoding is not supported.
RFC 2141 URN Syntax

The HTTP request body for the PUT Bucket policy operation must be encoded with charset=UTF-8.