Como usar: S3 Bucket Policy Generator
- The page starts in S3 bucket policy mode. Enter the bucket name and your account ID.
- Keep Deny without HTTPS on, and tick who may access the bucket: CloudFront, another account, an IAM role or the public.
- Fill in the distribution ID, account ID or role ARN, and optionally limit access to a prefix.
- Copy the policy, or run the AWS CLI command to apply it.
The usual bucket policies
- CloudFront (OAC): the bucket stays private; only your distribution may read it, checked with
AWS:SourceArn. - Cross-account: the other account’s root principal (or a role in it) may read or write objects.
- HTTPS only: a Deny statement for requests where
aws:SecureTransportis false — a common compliance requirement. - Public read:
Principal: "*"withs3:GetObject; needs Block Public Access off, so keep it to public website files.
For policies attached to users and roles, switch to IAM policy mode in the AWS IAM Policy Generator.
Também pesquisado como: s3 bucket policy example, cloudfront oac bucket policy, s3 public read policy, s3 cross account bucket policy, enforce https s3 bucket policy.
Ferramentas que combinam com: S3 Bucket Policy Generator
- CORS Header Generator & Tester — Seeing “has been blocked by CORS policy”?
- Kubernetes YAML Generator — Fill in your app’s name, image and port and get production-ready Kubernetes YAML: a Deployment with probes, resource limits and a hardened security context, plus the Service, Ingress with TLS, ConfigMap, Secret and HorizontalPodAutoscaler you tick — in one file ready for kubectl apply.
- Formatação JSON — Cole o JSON aqui para formatá-lo, compactá-lo ou validá-lo.
- Security Headers Checker — Grade a site’s HTTP security headers from A+ to F, see which are missing and why they matter, and copy ready-made config snippets for Nginx, Apache, Netlify, Vercel or Cloudflare.
Perguntas frequentes
How do I let CloudFront read a private S3 bucket?
Create an Origin Access Control in CloudFront, then add a bucket policy that allows the cloudfront.amazonaws.com service principal to s3:GetObject, with an AWS:SourceArn condition for your distribution. Tick “Allow CloudFront” here.
How do I make an S3 bucket public?
Turn off Block Public Access for the bucket and add a policy that allows Principal "*" to s3:GetObject. Only do this for files that are meant to be public.
How do I enforce HTTPS on an S3 bucket?
Add a Deny statement for all principals and actions when aws:SecureTransport is false. The generator adds it by default.
Posso instalar o S3 Bucket Policy Generator como um aplicativo da web e usá-lo offline?
Sim. O S3 Bucket Policy Generator é um aplicativo da web instalável (PWA) — instalado a partir do seu navegador, não baixado de uma loja de aplicativos. Clique em “Instalar aplicativo” na parte superior desta página no Chrome ou no Edge (Windows, macOS, Linux, ChromeOS) ou, no Android, use “Compartilhar” → “Adicionar à tela inicial” no iPhone e no iPad, ou “Arquivo” → “Adicionar ao Dock” no Safari 17+ em um Mac. Em seguida, ela se abre em uma janela própria com seu próprio ícone e, como é executada inteiramente no seu navegador, continua funcionando offline. O Firefox no desktop não permite a instalação de aplicativos da web. Como funciona a instalação.