--- title: "Identity and Bucket Policy Reference" slug: "identity-and-bucket-policy-reference-tg" tags: ["5.4"] updated: 2026-10-28T01:54:43Z published: 2026-10-28T01:54:43Z canonical: "docs.vastdata.com/identity-and-bucket-policy-reference-tg" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt > Use this file to discover all available pages before exploring further. # Identity and Bucket Policy Reference - [Identity and Bucket Policy Format](/docs-5-4/docs/en/identity-and-bucket-policy-reference-tg#identity-and-bucket-policy-format) - [Supported Elements in Identity and Bucket Policies](/docs-5-4/docs/en/identity-and-bucket-policy-reference-tg#supported-elements-in-identity-and-bucket-policies) - [Supported Condition Operators](/docs-5-4/docs/en/identity-and-bucket-policy-reference-tg#supported-condition-operators) - [Supported Condition Keys per S3 Action](/docs-5-4/docs/en/identity-and-bucket-policy-reference-tg#supported-condition-keys-per-s3-action) - [Supported Condition Key Qualifiers for Keys with Multiple Values](/docs-5-4/docs/en/identity-and-bucket-policy-reference-tg#supported-condition-key-qualifiers-for-keys-with-multiple-values) - [Supported Variables](/docs-5-4/docs/en/identity-and-bucket-policy-reference-tg#supported-variables) - [Identity Policy Examples](/docs-5-4/docs/en/identity-and-bucket-policy-reference-tg#identity-policy-examples) - [Bucket Policy Examples](/docs-5-4/docs/en/identity-and-bucket-policy-reference-tg#bucket-policy-examples) ## Identity and Bucket Policy Format Identity and bucket policies support a subset of elements listed in Amazon's [IAM JSON Policy Reference](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html). Both identity and bucket policies comprise a series of statements. Each statement allows or denies a set of S3 actions on a set of S3 resources. The identity policy syntax is: ```plaintext  {      "Version": "2012-10-17",      "Statement": [{          "Sid": "",          ("Action" | "NotAction"): (              "s3:" |              ["s3:", "s3:", ...] |              "*"),          "Effect": (              "Allow" |              "Deny"),          ("Resource" | "NotResource"): (              [, , ...] |              "*"),          "Condition": {"": {"": ""}}      }]    } ``` The bucket policy syntax is: ```plaintext  {      "Version": "2012-10-17",      "Statement": [{          "Sid": "",          "Principal": (              "User": "" |              "User": ["", "", ...] |              "Group": "" |                  "Group": ["", "", ...] |              "*")          ("Action" | "NotAction"): (              "s3:" |              ["s3:", "s3:", ...] |              "*"),          "Effect": (              "Allow" |              "Deny"),          ("Resource" | "NotResource"): (              [, , ...] |              "*"),          "Condition": {"": {"": ""}}      }]    } ``` Syntax rules and conventions: - The following characters are JSON tokens and are included in policies: `{ } [ ] " , :` - The following characters are special characters in the grammar and are **not** included in policies: `= < > ( ) |` - If an element allows multiple values, it is indicated using repeated values, a comma delimiter, and an ellipsis (...). For example: `[<resource1>, <resource2>, ...]` - If multiple values are allowed, it is also valid to include only one value. For only one value, the trailing comma must be omitted. If the element takes an array (marked with [ and ]) but only one value is included, the brackets are optional. For example, both of the following are valid, with and without the brackets: `"Action": [<action>]` and `"Action": <action>` - A vertical line (|) between elements indicates alternatives. Parentheses in the syntax define the scope of the alternatives, for example: `("Action" | "NotAction")` - Elements that must be literal strings are enclosed in double quotation marks ("). For example, `"Allow"`. ## Supported Elements in Identity and Bucket Policies - ###### `Version` (Required) Specifies the version of the policy language (language syntax rules that are to be used to process the policy). ```plaintext "Version": "2012-10-17" ``` The only valid value is `2012-10-17`. - ###### `Statement` (Optional) Acts as a container for one or more permission statements. ```plaintext "Statement": [{    <...> }] ``` Each permission statement under the `Statement` element must be enclosed in curly braces { }. For multiple statements, the array must be enclosed in square brackets [ ]. - ###### `Sid` (Optional) An optional identifier that you can assign to each permission statement under the `Statement` element. The SID must be unique within a policy. > [!NOTE] > Note > > You can't retrieve a particular statement based on the SID value. ```plaintext "Sid": "" ``` `<SID>` can include ASCII uppercase letters (A-Z), lowercase letters (a-z), and numbers (0-9). - ###### `Principal` (Required in bucket policies, not used in identity policies) Lists one or more users or groups for which the specified actions are allowed or denied in a bucket policy. ```plaintext "Principal": {(     "User": "" |     "User": ["", "", ...] |     "Group": "" |         "Group": ["", "", ...] |     "*")} ``` `"*"` denotes all principals. In addition to the formats shown above, you can also specify users and groups in the same statement: ```plaintext "Principal": {"User": ["username1@domain1", "username2@domain2"],    "Group": ["groupname1@domain1", "groupname2@domain2"]} ``` If there are multiple authentication and authorization providers configured for a tenant, specifying the domain name is obligatory for non-local users. Otherwise, you can omit the `@domain` part. If a user or group exists on an Active Directory provider and is specified without the domain name, VAST Cluster matches the user or group against the joined domain. - ###### `Action` ###### `NotAction` (Required) Determines which actions are allowed or denied, depending on the policy effect: | | `Action` | `NotAction` | | --- | --- | --- | | `Effect` is `Allow` | Any actions listed under `Action` are allowed. | Any actions that are *not* listed under `NotAction` are allowed. | | `Effect` is `Deny` | Any actions listed under `Action` are denied. | Any actions that are *not* listed under `NotAction` are denied. | > [!TIP] > Tip > > Using `NotAction` can result in a shorter policy by listing only a few actions that should not match, rather than including a long list of actions that will match. ```plaintext ("Action" | "NotAction"):              ("s3:" |              ["s3:", "s3:", ...] |               "*") ``` `<ACTION>` is the AWS S3 action name of any supported S3 action: ```plaintext "Action": "s3:GetObject" ``` > [!NOTE] > Note > > For supported actions and their Amazon S3 action names, see [Supported S3 Requests](/docs-5-4/docs/en/supported-s3-requests-tg).Supported S3 Requests You can use the following wildcard characters or their combinations: - `*` (asterisk) to denote any number of characters - `?` (question mark) to denote a single character. For example: - To specify all actions beginning with *Get*, such as *GetBucket*, *GetObject* : ```plaintext "Action": "s3:Get*" ``` - To specify all actions that include the string *Object*, such as *GetObject*, *DeleteObject*, *ListObjects*: ```plaintext "Action": "S3:*Object*" ``` - To specify all actions: ```plaintext "Action": "S3:*" ``` ```plaintext "Action": "*" ``` - ###### `Effect` (Required) Determines whether the statement results in an allow or an explicit deny of the actions. ```plaintext "Effect": ("Allow" | "Deny") ``` - ###### `Resource` ###### `NotResource` (Required) Lists buckets and/or objects to which the policy statement applies. - With `Resource`, the policy statement applies to the specified buckets and/or objects. - With `NotResource`, the policy statement applies to any buckets and/or objects except those specified. ```plaintext ("Resource" | "NotResource"): (     [, , ...] |     "*") ``` You can specify one or more resource elements in a statement. You can use wildcards, for example: - To specify a bucket: ```plaintext "Resource": "arn:aws:s3:::" ``` - To specify all objects in a bucket: ```plaintext "Resource": "arn:aws:s3:::/*" ``` - To specify all objects in a bucket that have a certain prefix: ```plaintext "Resource": "arn:aws:s3:::/*" ``` - To specify an object in a bucket: ```plaintext "Resource": "arn:aws:s3:::/" ``` - To specify all buckets and objects: ```plaintext "Resource": "*" ``` > [!NOTE] > Note > > A bucket policy must explicitly specify the name of the bucket to which it applies. The `<resource>` string can include [supported variables](/docs-5-4/docs/en/identity-and-bucket-policy-reference-tg). - ###### `Condition` (Optional) Lists conditions to limit the effect of the policy to only those requests that match the conditions specified. A condition statement includes a [supported operator](/docs-5-4/docs/en/identity-and-bucket-policy-reference-tg#supported-condition-operators), a condition key and a key value. ```plaintext "Condition": {"": {"": ""}} ``` To evaluate keys with multiple values, include a [supported condition key qualifier:](/docs-5-4/docs/en/identity-and-bucket-policy-reference-tg#supported-condition-key-qualifiers-for-keys-with-multiple-values) ```plaintext "Condition": {":": {"": ["", "", ...]}} ``` String values (`<value>`) can include [supported variables](/docs-5-4/docs/en/identity-and-bucket-policy-reference-tg#supported-variables). ## Supported Condition Operators The following [AWS IAM JSON policy condition operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html) are supported in identity and bucket policies. The `IfExists` suffix means that if the condition key is not present in the request context, the policy statement is evaluated as a match (true) and the policy effect applies. | Type | Operator | Description | | --- | --- | --- | | General | `Null` | If the value is *true* (`"Condition":{"Null":{"<key>":"true"}}`), the policy is in effect when the specified condition key is absent at the authorization time. If the value is *false* (`"Condition":{"Null":{"<key>":"false"}}`), the policy is in effect when the specified condition key exists and has a certain value at the authorization time. | | String | `StringEquals` `StringEqualsIfExists` | The policy is in effect when the condition key matches the string specified as the value. The value can include supported variables. The comparison is case-sensitive. | | `StringNotEquals` `StringNotEqualsIfExists` | The policy is in effect when the condition key does not match the string specified as the value. The value can include supported variables. The comparison is case-sensitive. | | `StringEqualsIgnoreCase` `StringEqualsIgnoreCaseIfExists` | The policy is in effect when the condition key matches the string specified as the value. The value can include supported variables. The comparison is case-insensitive. | | `StringNotEqualsIgnoreCase` `StringNotEqualsIgnoreCaseIfExists` | The policy is in effect when the condition key does not match the string specified as the value. The value can include supported variables. The comparison is case-insensitive. | | `StringLike` `StringLikeIfExists` | The policy is in effect when the condition key matches the string specified as the value, which can include the following wildcards: - A question mark (?) denotes any single character. - An asterisk (*) denotes any number of characters. The value can include supported variables. The comparison is case-sensitive. | | `StringNotLike` `StringNotLikeIfExists` | The policy is in effect when the condition key does not match the string specified as the value, which can include the following wildcards: - A question mark (?) denotes any single character. - An asterisk (*) denotes any number of characters. The value can include supported variables. The comparison is case-sensitive. | | Numeric | `NumericEquals` `NumericEqualsIfExists` | The policy is in effect when the condition key equals the number specified as the value. | | `NumericNotEquals` `NumericNotEqualsIfExists` | The policy is in effect when the condition key does not equal the number specified as the value. | | `NumericLessThan` `NumericLessThanIfExists` | The policy is in effect when the condition key is less than the number specified as the value. | | `NumericLessThanEquals` `NumericLessThanEqualsIfExists` | The policy is in effect when the condition key is less than or equals the number specified as the value. | | `NumericGreaterThan` `NumericGreaterThanIfExists` | The policy is in effect when the condition key is greater than the value specified as the number. | | `GreaterThanEquals` `GreaterThanEqualsIfExists` | The policy is in effect when the condition key is greater than or equals the value specified as the number. | | Boolean | `Bool` `BoolIfExists` | The policy is in effect when the condition key matches the value. The value can be *True* or *False*. | | Binary | `BinaryEquals` `BinaryEqualsIfExists` | The policy is in effect when the condition key equals the binary number specified as the value. | | IP address | `IpAddress` `IpAddressIfExists` | The policy is in effect when the condition key matches the IP address or a range of IP addresses specified as the value. | | `NotIpAddress` `NotIpAddressIfExists` | The policy is in effect when the condition key does not match the IP address or a range of IP addresses specified as the value. | ## Supported Condition Keys per S3 Action The following [AWS IAM JSON policy condition keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html) can be included in the `Condition` element of an identity or bucket policy to compare a value from the request to the value specified in the policy: - General conditions | Condition Key | Description | Action(s) | | --- | --- | --- | | `aws:SourceIp` | Requester's IP address | Any action | | `aws:UserAgent` | Requester's client application | Any action | | `aws:CurrentTime` | Date and time (UTC) of the request | Any action | | `aws:EpochTime` | Date and time (UTC) of the request in epoch or Unix time | Any action | | `aws:username` | Requester's principal | Any action | | `s3:authType` | Authentication method: `REST-HEADER`, `REST-QUERY-STRING` or `POST`. | Any action | | `s3:TlsVersion` | Client's TLS version | Any action | | `vast:protocol` | Storage access protocol (NFSv3, NFSv4, SMB, S3) | Any action | - Request signing | Condition Key | Description | Action(s) | | --- | --- | --- | | `s3:signatureAge` | How long the signature is valid in a authenticated request (in milliseconds). This condition applies to presigned URLs and presigned POST requests. With AWS Signature 4, the maximum allowed signature age is 7 days, which can be further limited using this condition. With AWS Signature 2, the signature age is always 0. | Any action | | `s3:signatureversion` | AWS Signature version: `AWS` for version 2, `AWS4-HMAC-SHA256` for version 4. | Any action | | `s3:x-amz-content-sha256` | Unsigned content | AbortMultipartUpload CreateBucket DeleteBucket DeleteBucketPolicy DeleteObjectVersion GetBucketAcl GetBucketLocation GetBucketOwnershipControls GetBucketPolicy GetLifecycleConfiguration GetObject GetObjectAcl GetObjectTagging GetObjectVersion GetObjectVersionAcl DeleteObject DeleteObjectTagging DeleteObjectVersionTagging GetObjectLegalHold GetObjectRetention GetObjectVersionTagging ListAllMyBuckets ListBucket ListBucketMultiparUploads ListBucketVersions ListMultipartUploadPart PutBucketAcl PutBucketOwnershipControls PutBucketPolicy PutBucketTagging PutBucketVersioning PutLifecycleConfiguration PutObject PutObjectAcl PutObjectLegalHold PutObjectRetention PutObjectTagging PutObjectVersionTagging | - Object tagging | Condition Key | Description | Action(s) | | --- | --- | --- | | `s3:RequestObjectTag/<key>` | Tag keys and values to be added to objects | BypassGovernanceRetention DeleteObjectTagging DeleteObjectVersionTagging GetObject GetObjectAcl GetObjectTagging GetObjectVersion GetObjectVersionAcl GetObjectVersionTagging PutObject PutObjectAcl PutObjectTagging PutObjectVersionTagging | | `s3:RequestObjectTagKeys` | Tag keys to be added to objects | BypassGovernanceRetention PutObject PutObjectTagging PutObjectVersionTagging | - Permissions | Condition Key | Description | Action(s) | | --- | --- | --- | | `s3:x-amz-acl` | An `x-amz-acl` header with a canned ACL. Valid values: - `private` - `public-read` - `public-read-write` - `aws-exec-read` - `authenticated-read` - `bucket-owner-read` - `bucket-owner-full-control` - `log-delivery-write` | BypassGovernanceRetention CreateBucket PutBucketAcl PutObject PutObjectAcl | | `s3:x-amz-grant-full-control` | Requires that the S3 request includes a header that provides full control permissions to the bucket owner. | BypassGovernanceRetention CreateBucket PutBucketAcl PutObject PutObjectAcl | | `s3:x-amz-grant-read` | Requires that the S3 request includes a header that provides read permissions to the bucket owner. | BypassGovernanceRetention CreateBucket PutBucketAcl PutObject PutObjectAcl | | `s3:x-amz-grant-read-acp` | Requires that the S3 request includes a header that provides permissions to read ACL to the bucket owner. | BypassGovernanceRetention CreateBucket PutBucketAcl PutObject PutObjectAcl | | `s3:x-amz-grant-write` | Requires that the S3 request includes a header that provides write permissions to the bucket owner. | BypassGovernanceRetention CreateBucket PutBucketAcl PutObject PutObjectAcl | | `s3:x-amz-grant-write-acp` | Requires that the S3 request includes a header that provides permissions to write ACL to the bucket owner. | BypassGovernanceRetention CreateBucket PutBucketAcl PutObject PutObjectAcl | - Object ownership | Condition Key | Description | Action(s) | | --- | --- | --- | | `s3:x-amz-object-ownership` | Object ownership: `BucketOwnerEnforced` or `ObjectWriter` | CreateBucket | - Object versioning | Condition Key | Description | Action(s) | | --- | --- | --- | | `s3:versionid` | Object version | DeleteObjectVersion DeleteObjectVersionTagging GetObjectVersion GetObjectVersionAcl GetObjectVersionTagging PutObjectAcl PutObjectVersionTagging | - Object retention | Condition Key | Description | Action(s) | | --- | --- | --- | | `s3:object-lock-mode` | Object retention mode (COMPLIANCE or GOVERNANCE) | BypassGovernanceRetention PutObject PutObjectRetention | | `s3:object-lock-retain-until-date` | Object retain-until date | BypassGovernanceRetention PutObject PutObjectRetention | | `s3:object-lock-remaining-retention-days` | Remaining object retention days | BypassGovernanceRetention PutObject PutObjectRetention | | `s3:object-lock-legal-hold` | Object legal hold status | BypassGovernanceRetention PutObject PutObjectLegalHold PutObjectRetention | - Copying objects | Condition Key | Description | Action(s) | | --- | --- | --- | | `s3:x-amz-copy-source` | A specific source bucket, prefix or object in copy object requests | BypassGovernanceRetention PutObject | | `s3:x-amz-metadata-directive` | Object metadata processing mode (copy or replace) for copy object requests | BypassGovernanceRetention PutObject | - Listing buckets | Condition Key | Description | Action(s) | | --- | --- | --- | | `s3:delimiter` | Delimiter specified in the request. | ListBucket ListBucketVersions | | `s3:max-keys` | Maximum number of keys returned per ListBucket request | ListBucket ListBucketVersions | | `s3:prefix` | Key name prefix | ListBucket ListBucketVersions | ## Supported Condition Key Qualifiers for Keys with Multiple Values The `ForAllValues` and `ForAnyValue` [qualifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-single-vs-multi-valued-context-keys.html#reference_policies_condition-multi-valued-context-keys) let you compare request context keys with multiple values against a set of multiple values in a policy condition statement. | Qualifier | Description | | --- | --- | | `ForAllValues` | The policy is in effect when each key value in the request matches at least one of the multiple values for the key in the policy, and also when the request key is empty or does not exist. | | `ForAnyValue` | The policy is in effect when at least one key value in the request matches one of the multiple values for the key in the policy. When the request key is empty or does not exist, the policy is not in effect. | ## Supported Variables The following [AWS IAM JSON policy variables](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#policy-vars-using-variables) are supported: - In resource names under the `Resource` element: - `${userid}` - `${username}` - In condition values under the `Condition` element: - `${BucketName}` - `${ObjectName}` - `${username}` - `${aws:username}` For example: ```plaintext "Condition" : {  "StringEquals" : {    "s3:x-amz-grant-read"; : "id=${BucketName}"    }, ``` ## Identity Policy Examples The following identity policy grants a user access to one of your buckets, *bucket1*, and allows the user to add, update and delete objects. ```plaintext {   "Version":"2012-10-17",   "Statement":[      {         "Effect":"Allow",         "Action": "s3:ListAllMyBuckets",         "Resource":"*"      },      {         "Effect":"Allow",         "Action":["s3:ListObjects","s3:GetBucketLocation"],         "Resource":"arn:aws:s3:::bucket1"      },      {         "Effect":"Allow",         "Action":[            "s3:PutObject",            "s3:PutObjectAcl",            "s3:GetObject",            "s3:GetObjectAcl",            "s3:DeleteObject"         ],         "Resource":"arn:aws:s3:::bucket1/*"      }   ] } ``` The following identity policy grants permission to perform the *GetObject* action on all objects in the bucket *dev*: ```plaintext {  "Version": "2012-10-17",  "Statement": [    {      "Sid": "Allow All GetObject in dev Bucket",      "Action": [        "s3:GetObject"      ],      "Effect": "Allow",      "Resource": "arn:aws:s3:::dev/*"    }  ] } ``` The following identity policy grants permission for multiple actions on the bucket *product* and on all objects in the same bucket, while also denying delete permission on the same bucket and objects. ```plaintext {  "Version": "2012-10-17",  "Statement": [    {             "Sid": "Allow multiple actions on product bucket and its objects",      "Action": [        "s3:Get*",        "s3:Put*",        "s3:Head*",        "s3:List*"      ],      "Effect": "Allow",      "Resource": [        "arn:aws:s3:::product",        "arn:aws:s3:::product/*"      ]    },    {      "Sid": "Deny delete product bucket and objects",      "Action": [        "s3:DeleteBucket",        "s3:DeleteObject"      ],      "Effect": "Deny",      "Resource": [        "arn:aws:s3:::product",        "arn:aws:s3:::product/*"      ]    }  ]} ``` ## Bucket Policy Examples The following bucket policy allows users from the students group to read objects in bucket *bucket1*: ```plaintext {    "Version": "2012-10-17",    "Statement": [        {                "Sid": "Let students read",            "Effect": "Allow",              "Principal":  {"Group": "students@example.com"},              "Action": [ "s3:GetObject", "s3:ListBucket" ],            "Resource": ["arn:aws:s3:::bucket1","arn:aws:s3:::bucket1/*"]        }    ] } ``` The following bucket policy prohibits users Kevin and Martin from reading objects object with an object tag of 'category' with a value 'reports': ```plaintext {   "Version":"2012-10-17",   "Statement":[{         "Principal":{ "User": ["kevin@example.com", "martin@example.com"]},         "Effect":"Deny",         "Action":["s3:GetObject", "s3:GetObjectVersion"],         "Resource": ["arn:aws:s3:::bucket1/*"],         "Condition":{"StringEquals":{"s3:ExistingObjectTag/category":"reports"}}   }]     } ```