Bucket policies

A bucket policy is a JSON document attached to a bucket that allows or denies S3 actions. Use it to give another access key (even one from another DockHive account) access to part of a bucket, to make one folder public, or to deny requests from outside your network. Setting and removing a policy needs an Admin key.

How access is decided

1. An explicit Deny in the bucket policy refuses the request.
2. Otherwise the request is allowed if the access key’s own permission and scope allow it, if the bucket or object is public (anonymous downloads only), or if the policy has a matching Allow.
3. Anything else is denied.

A Deny can’t lock you out of the policy itself: the bucket owner’s Admin keys can always read, replace or delete it.

Policies can grant object operations and listing, to anonymous callers and to other access keys. Bucket settings (CORS, versioning, policies, and so on) always stay with the owner’s keys. Requests allowed by a policy are billed to the bucket owner.

Supported elements

Element	Supported values
Version	2012-10-17 or 2008-10-17
Statement	One statement object or a list
Sid	Any
Effect	Allow, Deny
Principal	"*" (anyone, including anonymous), or {"AWS": ["DH..."]} with Hive Buckets access key IDs that exist
Action	S3 actions such as s3:GetObject, s3:PutObject, s3:ListBucket, with wildcards (s3:Get*, s3:*)
Resource	arn:aws:s3:::<bucket> and arn:aws:s3:::<bucket>/<pattern> (wildcards allowed in the pattern)
Condition	IpAddress / NotIpAddress on aws:SourceIp; StringEquals, StringNotEquals, StringLike, StringNotLike on s3:prefix; Bool on aws:SecureTransport

NotPrincipal, NotAction, NotResource, IAM user or role ARNs, ...IfExists operators and other condition keys aren’t supported. A policy that uses them is refused with MalformedPolicy and a reason.

Apply a policy

EP=https://s3.dockhive.io
aws s3api put-bucket-policy --bucket my-app-uploads --policy file://policy.json --endpoint-url $EP
aws s3api get-bucket-policy --bucket my-app-uploads --endpoint-url $EP
aws s3api delete-bucket-policy --bucket my-app-uploads --endpoint-url $EP

Examples

Make one folder public

Block Public Access must be off for public statements to work (a policy granting access to "*" is refused while it’s on).

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicImages",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-app-uploads/public/*"
    }
  ]
}

Give another access key read access to a prefix

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": ["DHEXAMPLEKEYID"] },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-app-uploads/shared/*"
    },
    {
      "Effect": "Allow",
      "Principal": { "AWS": ["DHEXAMPLEKEYID"] },
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::my-app-uploads",
      "Condition": { "StringLike": { "s3:prefix": "shared/*" } }
    }
  ]
}

Deny everything from outside your network

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": ["arn:aws:s3:::my-app-uploads", "arn:aws:s3:::my-app-uploads/*"],
      "Condition": { "NotIpAddress": { "aws:SourceIp": ["203.0.113.0/24"] } }
    }
  ]
}

Require HTTPS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": ["arn:aws:s3:::my-app-uploads", "arn:aws:s3:::my-app-uploads/*"],
      "Condition": { "Bool": { "aws:SecureTransport": "false" } }
    }
  ]
}

Block Public Access and policies

A statement that allows "*" is public unless it’s limited with an aws:SourceIp condition. While Block Public Access is on, such a policy is refused, and public statements in an existing policy are ignored if you turn it on later. get-bucket-policy-status shows whether the bucket is public.