バケット ポリシーでは、そのポリシーが関連付けられたバケットに対するアクセス権限を指定します。バケット ポリシーは、S3 PutBucketPolicy APIを使用して設定します。
バケット ポリシーを設定するには、AWS CLIで次のコマンドを使用します。
> aws s3api put-bucket-policy --bucket examplebucket --policy file://policy.json
{ "Statement": [ { "Sid": "AllowEveryoneReadOnlyAccess", "Effect": "Allow", "Principal": "*", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": ["arn:aws:s3:::examplebucket","arn:aws:s3:::examplebucket/*"] } ] }
{ "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "95390887230002558202" }, "Action": "s3:*", "Resource": [ "arn:aws:s3:::examplebucket", "arn:aws:s3:::examplebucket/*" ] }, { "Effect": "Allow", "Principal": { "AWS": "31181711887329436680" }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::examplebucket/shared/*" }, { "Effect": "Allow", "Principal": { "AWS": "31181711887329436680" }, "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::examplebucket", "Condition": { "StringLike": { "s3:prefix": "shared/*" } } } ] }
{ "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::95390887230002558202:federated-group/Marketing" }, "Action": "s3:*", "Resource": [ "arn:aws:s3:::examplebucket", "arn:aws:s3:::examplebucket/*" ] }, { "Effect": "Allow", "Principal": "*", "Action": ["s3:ListBucket","s3:GetObject"], "Resource": [ "arn:aws:s3:::examplebucket", "arn:aws:s3:::examplebucket/*" ] } ] }
{ "Statement": [ { "Sid": "AllowEveryoneReadWriteAccessIfInSourceIpRange", "Effect": "Allow", "Principal": "*", "Action": [ "s3:*Object", "s3:ListBucket" ], "Resource": ["arn:aws:s3:::examplebucket","arn:aws:s3:::examplebucket/*"], "Condition": { "IpAddress": {"aws:SourceIp": "54.240.143.0/24"}, "NotIpAddress": {"aws:SourceIp": "54.240.143.188"} } } ] }
{ "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::95390887230002558202:federated-user/Bob" }, "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::examplebucket", "arn:aws:s3:::examplebucket/*" ] }, { "Effect": "Deny", "NotPrincipal": { "AWS": "arn:aws:iam::95390887230002558202:federated-user/Bob" }, "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::examplebucket", "arn:aws:s3:::examplebucket/*" ] } ] }