Comment utiliser : S3 Bucket Policy Generator
- The page starts in S3 bucket policy mode. Enter the bucket name and your account ID.
- Keep Deny without HTTPS on, and tick who may access the bucket: CloudFront, another account, an IAM role or the public.
- Fill in the distribution ID, account ID or role ARN, and optionally limit access to a prefix.
- Copy the policy, or run the AWS CLI command to apply it.
The usual bucket policies
- CloudFront (OAC): the bucket stays private; only your distribution may read it, checked with
AWS:SourceArn. - Cross-account: the other account’s root principal (or a role in it) may read or write objects.
- HTTPS only: a Deny statement for requests where
aws:SecureTransportis false — a common compliance requirement. - Public read:
Principal: "*"withs3:GetObject; needs Block Public Access off, so keep it to public website files.
For policies attached to users and roles, switch to IAM policy mode in the AWS IAM Policy Generator.
Aussi recherché comme : s3 bucket policy example, cloudfront oac bucket policy, s3 public read policy, s3 cross account bucket policy, enforce https s3 bucket policy.
Outils complémentaires : S3 Bucket Policy Generator
- CORS Header Generator & Tester — Seeing “has been blocked by CORS policy”?
- Kubernetes YAML Generator — Fill in your app’s name, image and port and get production-ready Kubernetes YAML: a Deployment with probes, resource limits and a hardened security context, plus the Service, Ingress with TLS, ConfigMap, Secret and HorizontalPodAutoscaler you tick — in one file ready for kubectl apply.
- Formateur JSON — Collez votre code JSON pour le formater, le compresser ou le valider.
- Security Headers Checker — Grade a site’s HTTP security headers from A+ to F, see which are missing and why they matter, and copy ready-made config snippets for Nginx, Apache, Netlify, Vercel or Cloudflare.
Questions fréquentes
How do I let CloudFront read a private S3 bucket?
Create an Origin Access Control in CloudFront, then add a bucket policy that allows the cloudfront.amazonaws.com service principal to s3:GetObject, with an AWS:SourceArn condition for your distribution. Tick “Allow CloudFront” here.
How do I make an S3 bucket public?
Turn off Block Public Access for the bucket and add a policy that allows Principal "*" to s3:GetObject. Only do this for files that are meant to be public.
How do I enforce HTTPS on an S3 bucket?
Add a Deny statement for all principals and actions when aws:SecureTransport is false. The generator adds it by default.
Puis-je installer S3 Bucket Policy Generator en tant qu’application web et l’utiliser hors ligne ?
Oui. S3 Bucket Policy Generator est une application web installable (PWA) : elle s’installe depuis votre navigateur, sans passer par une boutique d’applications. Cliquez sur « Installer l’application » en haut de cette page dans Chrome ou Edge (Windows, macOS, Linux, ChromeOS) ; sur Android, utilisez « Partager » → « Ajouter à l’écran d’accueil » sur iPhone et iPad ; ou « Fichier » → « Ajouter au Dock » dans Safari 17+ sur Mac. L’application s’ouvre alors dans sa propre fenêtre avec sa propre icône, et comme elle s’exécute entièrement dans votre navigateur, elle continue de fonctionner hors ligne. Firefox sur ordinateur de bureau ne permet pas d’installer d’applications web. Comment fonctionne l’installation.