Cómo usar: S3 Bucket Policy Generator
- The page starts in S3 bucket policy mode. Enter the bucket name and your account ID.
- Keep Deny without HTTPS on, and tick who may access the bucket: CloudFront, another account, an IAM role or the public.
- Fill in the distribution ID, account ID or role ARN, and optionally limit access to a prefix.
- Copy the policy, or run the AWS CLI command to apply it.
The usual bucket policies
- CloudFront (OAC): the bucket stays private; only your distribution may read it, checked with
AWS:SourceArn. - Cross-account: the other account’s root principal (or a role in it) may read or write objects.
- HTTPS only: a Deny statement for requests where
aws:SecureTransportis false — a common compliance requirement. - Public read:
Principal: "*"withs3:GetObject; needs Block Public Access off, so keep it to public website files.
For policies attached to users and roles, switch to IAM policy mode in the AWS IAM Policy Generator.
También se busca como: s3 bucket policy example, cloudfront oac bucket policy, s3 public read policy, s3 cross account bucket policy, enforce https s3 bucket policy.
Herramientas que combinan con: S3 Bucket Policy Generator
- CORS Header Generator & Tester — Seeing “has been blocked by CORS policy”?
- Kubernetes YAML Generator — Fill in your app’s name, image and port and get production-ready Kubernetes YAML: a Deployment with probes, resource limits and a hardened security context, plus the Service, Ingress with TLS, ConfigMap, Secret and HorizontalPodAutoscaler you tick — in one file ready for kubectl apply.
- Formateador JSON — Pega el código JSON para formatearlo, minimizarlo o validarlo.
- Security Headers Checker — Grade a site’s HTTP security headers from A+ to F, see which are missing and why they matter, and copy ready-made config snippets for Nginx, Apache, Netlify, Vercel or Cloudflare.
Preguntas frecuentes
How do I let CloudFront read a private S3 bucket?
Create an Origin Access Control in CloudFront, then add a bucket policy that allows the cloudfront.amazonaws.com service principal to s3:GetObject, with an AWS:SourceArn condition for your distribution. Tick “Allow CloudFront” here.
How do I make an S3 bucket public?
Turn off Block Public Access for the bucket and add a policy that allows Principal "*" to s3:GetObject. Only do this for files that are meant to be public.
How do I enforce HTTPS on an S3 bucket?
Add a Deny statement for all principals and actions when aws:SecureTransport is false. The generator adds it by default.
¿Puedo instalar S3 Bucket Policy Generator como aplicación web y utilizarla sin conexión?
Sí. S3 Bucket Policy Generator es una aplicación web instalable (PWA): se instala desde el navegador, no se descarga desde una tienda de aplicaciones. Haz clic en «Instalar aplicación» en la parte superior de esta página en Chrome o Edge (Windows, macOS, Linux, ChromeOS) o, en Android, utiliza «Compartir» → «Añadir a la pantalla de inicio» en iPhone y iPad, o «Archivo» → «Añadir al Dock» en Safari 17+ en un Mac. A continuación, se abrirá en su propia ventana con su propio icono y, como se ejecuta íntegramente en tu navegador, seguirá funcionando sin conexión. Firefox en el ordenador de sobremesa no permite instalar aplicaciones web. Cómo funciona la instalación.