How to use the S3 Bucket Policy Generator
- The page starts in S3 bucket policy mode. Enter the bucket name and your account ID.
- Keep Deny without HTTPS on, and tick who may access the bucket: CloudFront, another account, an IAM role or the public.
- Fill in the distribution ID, account ID or role ARN, and optionally limit access to a prefix.
- Copy the policy, or run the AWS CLI command to apply it.
The usual bucket policies
- CloudFront (OAC): the bucket stays private; only your distribution may read it, checked with
AWS:SourceArn. - Cross-account: the other account’s root principal (or a role in it) may read or write objects.
- HTTPS only: a Deny statement for requests where
aws:SecureTransportis false — a common compliance requirement. - Public read:
Principal: "*"withs3:GetObject; needs Block Public Access off, so keep it to public website files.
For policies attached to users and roles, switch to IAM policy mode in the AWS IAM Policy Generator.
Also searched as: s3 bucket policy example, cloudfront oac bucket policy, s3 public read policy, s3 cross account bucket policy, enforce https s3 bucket policy.
Tools that pair well with the S3 Bucket Policy Generator
- CORS Header Generator & Tester — Seeing “has been blocked by CORS policy”?
- Kubernetes YAML Generator — Fill in your app’s name, image and port and get production-ready Kubernetes YAML: a Deployment with probes, resource limits and a hardened security context, plus the Service, Ingress with TLS, ConfigMap, Secret and HorizontalPodAutoscaler you tick — in one file ready for kubectl apply.
- JSON Formatter — Paste JSON to pretty-print, minify or validate it.
- Security Headers Checker — Grade a site’s HTTP security headers from A+ to F, see which are missing and why they matter, and copy ready-made config snippets for Nginx, Apache, Netlify, Vercel or Cloudflare.
Frequently asked questions
How do I let CloudFront read a private S3 bucket?
Create an Origin Access Control in CloudFront, then add a bucket policy that allows the cloudfront.amazonaws.com service principal to s3:GetObject, with an AWS:SourceArn condition for your distribution. Tick “Allow CloudFront” here.
How do I make an S3 bucket public?
Turn off Block Public Access for the bucket and add a policy that allows Principal "*" to s3:GetObject. Only do this for files that are meant to be public.
How do I enforce HTTPS on an S3 bucket?
Add a Deny statement for all principals and actions when aws:SecureTransport is false. The generator adds it by default.
Can I install S3 Bucket Policy Generator as a web app and use it offline?
Yes. S3 Bucket Policy Generator is an installable web app (PWA) — installed from your browser, not downloaded from an app store. Click Install app at the top of this page in Chrome or Edge (Windows, macOS, Linux, ChromeOS) or on Android, use Share → Add to Home Screen on iPhone and iPad, or File → Add to Dock in Safari 17+ on a Mac. It then opens in its own window with its own icon, and because it runs entirely in your browser it keeps working offline. Firefox on desktop can’t install web apps. How installing works.