---
title: "Managing Bucket Policies"
slug: "managing-bucket-policies-tg"
tags: ["5.5"]
updated: 2026-10-27T23:00:54Z
published: 2026-10-27T23:00:54Z
canonical: "docs.vastdata.com/managing-bucket-policies-tg"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing Bucket Policies

## Overview of Bucket Policies

A JSON-based [bucket policy](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-policies.html) can be attached to a view for protocols NFSv3, NFSv2, S3, and SMB, that has the *S3 security flavor* enabled. It defines actions that particular user(s) and/or group(s) are allowed or denied to perform against this view, and the files or directories under that view.

Bucket policies can be managed by sending `PutBucketPolicy`, `GetBucketPolicy` and `DeleteBucketPolicy` requests to the VAST S3 API.

## Creating a Bucket Policy

Bucket policies support a subset of the elements listed in Amazon's [IAM JSON Policy Reference](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html). For information about the required JSON format, supported elements and examples, see [Identity and Bucket Policy Reference](/docs-5-5/docs/identity-and-bucket-policy-reference-tg).

Bucket policies are created in the same [format](/docs-5-5/docs/identity-and-bucket-policy-reference-tg) as identity policies, with the following exceptions:

- You have to specify principals using the `Principal` element. The `Principal` element specifies the users, groups, or IAM roles, for which permissions are granted or denied.
- A bucket policy cannot specify a resource where the prefix does not contain the bucket name.
- A bucket policy cannot include the `BucketCreate` action.

A bucket policy can be up to 20 KB.

## Attaching a Bucket Policy to a View

Only the bucket owner can attach a bucket policy to the view that exposes the bucket.

There can be only one bucket policy per view. Attaching a new bucket policy to a view will override the previous bucket policy.

The view that exposes the bucket must meet the following requirements:

- The view has the S3 protocol enabled.
- The view is controlled with the *S3 Native* security flavor (through the attached view policy).

To attach a bucket policy, use your S3 client to send a `PutBucketPolicy` request to the VAST S3 server.

## Viewing a Bucket Policy Attached to a View

To view the bucket policy configuration set for a view, use your S3 client to send a `GetBucketPolicy` request to the VAST S3 server.

## Deleting a Bucket Policy

To delete a bucket policy attached to a view, use your S3 client to send a `DeleteBucketPolicy` request to the VAST S3 server.

The attached bucket policy is also deleted when:

- The view to which it is attached is deleted.
- The S3 protocol is removed from the list of protocols enabled for the view.

## Bucket Policy Examples

- To grant permissions to list and get objects from ​`my-bucket`​​ to any authenticated principal:

```plaintext
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAllRead",
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    }
  ]
}
```

Note that if the view has the *​Allow Anonymous Access*​​ option enabled, this policy allows access by any user without authentication being required.
- To grant permissions to put, get and delete objects in `​my-bucket`​​ to local users Alice and Bob, as well as users from user groups Finance and Ops:

```plaintext
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "LocalUsersAndGroups",
      "Effect": "Allow",
      "Principal": {
        "User": ["alice", "bob"],
        "Group": ["finance", "ops"]
      },
      "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}
```
- To grant permissions to list, get and put objects to users and groups on multi-domain Active Directory:

```plaintext
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "MultiDomainAD",
      "Effect": "Allow",
      "Principal": {
        "User": [
          "john@corp.example.com",
          "jane@emea.example.com",
          "svc-backup@dr.example.com"
        ],
        "Group": [
          "Finance@corp.example.com",
          "RnD@emea.example.com"
        ]
      },
      "Action": ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    }
  ]
}
```
- To grant permissions to list and put objjects to users associated with IAM roles DataIngestRole and AnalyticsReadRole:

```plaintext
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowIamRole",
      "Effect": "Allow",
      "Principal": {
        "Role": ["DataIngestRole", "AnalyticsReadRole"]
      },
      "Action": ["s3:PutObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    }
  ]
}
```
- ​To grant permissions to user Alice and members of the Finance group on condition that they access ​`my-bucket`​​ from IPs from the specified ranges:

```plaintext
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowFromCorpNet",
      "Effect": "Allow",
      "Principal": {
        "User": ["alice@corp.example.com"],
        "Group": ["Finance@corp.example.com"]
      },
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": ["10.10.0.0/16", "192.168.50.0/24"]
        }
      }
    }
  ]
}
```
- To grant permissions to list and get objects prefixed with ​`team-rnd/`​​, `​shared/​` to members of LDAP groups ​RnD@emea.example.com​ and ​developers@openldap.lab​​:

```plaintext
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListOnlyTeamPrefix",
      "Effect": "Allow",
      "Principal": {
        "Group": ["RnD@emea.example.com", "developers@openldap.lab"]
      },
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::my-bucket",
      "Condition": {
        "StringLike": {
          "s3:prefix": ["team-rnd/*", "shared/*"]
        }
      }
    },
    {
      "Sid": "ReadTeamObjects",
      "Effect": "Allow",
      "Principal": {
        "Group": ["RnD@emea.example.com", "developers@openldap.lab"]
      },
      "Action": "s3:GetObject",
      "Resource": [
        "arn:aws:s3:::my-bucket/team-rnd/*",
        "arn:aws:s3:::my-bucket/shared/*"
      ]
    }
  ]
}
```

​