Actions, resources, and condition keys for Amazon S3

Amazon S3 (service prefix: s3) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.

Actions defined by Amazon S3

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys	Dependent actions
AbortMultipartUpload	Grants permission to abort a multipart upload	Write	object*
AbortMultipartUpload	Grants permission to abort a multipart upload	Write		s3:DataAccessPointArn s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
AssociateAccessGrantsIdentityCenter	Grants permission to associate Access Grants identity center	Write	accessgrantsinstance*
AssociateAccessGrantsIdentityCenter		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
BypassGovernanceRetention	Grants permission to allow circumvention of governance-mode object retention settings	Permissions management	object*
BypassGovernanceRetention		Permissions management		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-copy-source s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-metadata-directive s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id s3:x-amz-server-side-encryption-customer-algorithm s3:x-amz-storage-class s3:x-amz-website-redirect-location s3:object-lock-mode s3:object-lock-retain-until-date s3:object-lock-remaining-retention-days s3:object-lock-legal-hold
CreateAccessGrant	Grants permission to create Access Grant	Write	accessgrantslocation*
CreateAccessGrant	Grants permission to create Access Grant	Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey} aws:RequestTag/${TagKey} aws:TagKeys
CreateAccessGrantsInstance	Grants permission to Create Access Grants Instance	Write	accessgrantsinstance*
CreateAccessGrantsInstance	Grants permission to Create Access Grants Instance	Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateAccessGrantsLocation	Grants permission to create Access Grants location	Write	accessgrantsinstance*
CreateAccessGrantsLocation	Grants permission to create Access Grants location	Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey} aws:RequestTag/${TagKey} aws:TagKeys
CreateAccessPoint	Grants permission to create a new access point	Write	accesspoint*
CreateAccessPoint	Grants permission to create a new access point	Write		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:locationconstraint s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256
CreateAccessPointForObjectLambda	Grants permission to create an object lambda enabled accesspoint	Write	objectlambdaaccesspoint*
CreateAccessPointForObjectLambda		Write		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
CreateBucket	Grants permission to create a new bucket	Write	bucket*
CreateBucket	Grants permission to create a new bucket	Write		s3:authType s3:locationconstraint s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-object-ownership
CreateJob	Grants permission to create a new Amazon S3 Batch Operations job	Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:RequestJobPriority s3:RequestJobOperation aws:TagKeys aws:RequestTag/${TagKey}	iam:PassRole
CreateMultiRegionAccessPoint	Grants permission to create a new Multi-Region Access Point	Write	multiregionaccesspoint*
CreateMultiRegionAccessPoint	Grants permission to create a new Multi-Region Access Point	Write		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
CreateStorageLensGroup	Grants permission to create an Amazon S3 Storage Lens group	Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:RequestTag/${TagKey} aws:TagKeys
DeleteAccessGrant	Grants permission to delete Access Grant	Write	accessgrant*
DeleteAccessGrant	Grants permission to delete Access Grant	Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
DeleteAccessGrantsInstance	Grants permission to Delete Access Grants Instance	Write	accessgrantsinstance*
DeleteAccessGrantsInstance	Grants permission to Delete Access Grants Instance	Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
DeleteAccessGrantsInstanceResourcePolicy	Grants permission to read Access grants instance resource policy	Write	accessgrantsinstance*
DeleteAccessGrantsInstanceResourcePolicy		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
DeleteAccessGrantsLocation	Grants permission to delete Access Grants location	Write	accessgrantslocation*
DeleteAccessGrantsLocation	Grants permission to delete Access Grants location	Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
DeleteAccessPoint	Grants permission to delete the access point named in the URI	Write	accesspoint*
DeleteAccessPoint		Write		s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteAccessPointForObjectLambda	Grants permission to delete the object lambda enabled access point named in the URI	Write	objectlambdaaccesspoint*
DeleteAccessPointForObjectLambda		Write		s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteAccessPointPolicy	Grants permission to delete the policy on a specified access point	Permissions management	accesspoint*
DeleteAccessPointPolicy		Permissions management		s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteAccessPointPolicyForObjectLambda	Grants permission to delete the policy on a specified object lambda enabled access point	Permissions management	objectlambdaaccesspoint*
DeleteAccessPointPolicyForObjectLambda		Permissions management		s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteBucket	Grants permission to delete the bucket named in the URI	Write	bucket*
DeleteBucket	Grants permission to delete the bucket named in the URI	Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteBucketPolicy	Grants permission to delete the policy on a specified bucket	Permissions management	bucket*
DeleteBucketPolicy		Permissions management		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteBucketWebsite	Grants permission to remove the website configuration for a bucket	Write	bucket*
DeleteBucketWebsite		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteJobTagging	Grants permission to remove tags from an existing Amazon S3 Batch Operations job	Tagging	job*
DeleteJobTagging		Tagging		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:ExistingJobPriority s3:ExistingJobOperation
DeleteMultiRegionAccessPoint	Grants permission to delete the Multi-Region Access Point named in the URI	Write	multiregionaccesspoint*
DeleteMultiRegionAccessPoint		Write		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
DeleteObject	Grants permission to remove the null version of an object and insert a delete marker, which becomes the current version of the object	Write	object*
DeleteObject		Write		s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteObjectTagging	Grants permission to use the tagging subresource to remove the entire tag set from the specified object	Tagging	object*
DeleteObjectTagging		Tagging		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteObjectVersion	Grants permission to remove a specific version of an object	Write	object*
DeleteObjectVersion	Grants permission to remove a specific version of an object	Write		s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
DeleteObjectVersionTagging	Grants permission to remove the entire tag set for a specific version of the object	Tagging	object*
DeleteObjectVersionTagging		Tagging		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
DeleteStorageLensConfiguration	Grants permission to delete an existing Amazon S3 Storage Lens configuration	Write	storagelensconfiguration*
DeleteStorageLensConfiguration		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteStorageLensConfigurationTagging	Grants permission to remove tags from an existing Amazon S3 Storage Lens configuration	Tagging	storagelensconfiguration*
DeleteStorageLensConfigurationTagging		Tagging		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteStorageLensGroup	Grants permission to delete an existing S3 Storage Lens group	Write	storagelensgroup*
DeleteStorageLensGroup		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DescribeJob	Grants permission to retrieve the configuration parameters and status for a batch operations job	Read	job*
DescribeJob		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DescribeMultiRegionAccessPointOperation	Grants permission to retrieve the configurations for a Multi-Region Access Point	Read	multiregionaccesspointrequestarn*
DescribeMultiRegionAccessPointOperation		Read		s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
DissociateAccessGrantsIdentityCenter	Grants permission to disassociate Access Grants identity center	Write	accessgrantsinstance*
DissociateAccessGrantsIdentityCenter		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetAccelerateConfiguration	Grants permission to uses the accelerate subresource to return the Transfer Acceleration state of a bucket, which is either Enabled or Suspended	Read	bucket*
GetAccelerateConfiguration		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccessGrant	Grants permission to read Access Grant	Read	accessgrant*
GetAccessGrant	Grants permission to read Access Grant	Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetAccessGrantsInstance	Grants permission to Read Access Grants Instance	Read	accessgrantsinstance*
GetAccessGrantsInstance	Grants permission to Read Access Grants Instance	Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetAccessGrantsInstanceForPrefix	Grants permission to Read Access Grants Instance by prefix	Read	accessgrantsinstance*
GetAccessGrantsInstanceForPrefix	Grants permission to Read Access Grants Instance by prefix	Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetAccessGrantsInstanceResourcePolicy	Grants permission to read Access grants instance resource policy	Read	accessgrantsinstance*
GetAccessGrantsInstanceResourcePolicy		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetAccessGrantsLocation	Grants permission to read Access Grants location	Read	accessgrantslocation*
GetAccessGrantsLocation	Grants permission to read Access Grants location	Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetAccessPoint	Grants permission to return configuration information about the specified access point	Read		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccessPointConfigurationForObjectLambda	Grants permission to retrieve the configuration of the object lambda enabled access point	Read	objectlambdaaccesspoint*
GetAccessPointConfigurationForObjectLambda		Read		s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccessPointForObjectLambda	Grants permission to create an object lambda enabled accesspoint	Read	objectlambdaaccesspoint*
GetAccessPointForObjectLambda		Read		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccessPointPolicy	Grants permission to return the access point policy associated with the specified access point	Read	accesspoint*
GetAccessPointPolicy		Read		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccessPointPolicyForObjectLambda	Grants permission to return the access point policy associated with the specified object lambda enabled access point	Read	objectlambdaaccesspoint*
GetAccessPointPolicyForObjectLambda		Read		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccessPointPolicyStatus	Grants permission to return the policy status for a specific access point policy	Read	accesspoint*
GetAccessPointPolicyStatus		Read		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccessPointPolicyStatusForObjectLambda	Grants permission to return the policy status for a specific object lambda access point policy	Read	objectlambdaaccesspoint*
GetAccessPointPolicyStatusForObjectLambda		Read		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccountPublicAccessBlock	Grants permission to retrieve the PublicAccessBlock configuration for an AWS account	Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAnalyticsConfiguration	Grants permission to get an analytics configuration from an Amazon S3 bucket, identified by the analytics configuration ID	Read	bucket*
GetAnalyticsConfiguration		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketAcl	Grants permission to use the acl subresource to return the access control list (ACL) of an Amazon S3 bucket	Read	bucket*
GetBucketAcl		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketCORS	Grants permission to return the CORS configuration information set for an Amazon S3 bucket	Read	bucket*
GetBucketCORS		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketLocation	Grants permission to return the Region that an Amazon S3 bucket resides in	Read	bucket*
GetBucketLocation		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketLogging	Grants permission to return the logging status of an Amazon S3 bucket and the permissions users have to view or modify that status	Read	bucket*
GetBucketLogging		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketNotification	Grants permission to get the notification configuration of an Amazon S3 bucket	Read	bucket*
GetBucketNotification		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketObjectLockConfiguration	Grants permission to get the Object Lock configuration of an Amazon S3 bucket	Read	bucket*
GetBucketObjectLockConfiguration		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:signatureversion
GetBucketOwnershipControls	Grants permission to retrieve ownership controls on a bucket	Read	bucket*
GetBucketOwnershipControls		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketPolicy	Grants permission to return the policy of the specified bucket	Read	bucket*
GetBucketPolicy		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketPolicyStatus	Grants permission to retrieve the policy status for a specific Amazon S3 bucket, which indicates whether the bucket is public	Read	bucket*
GetBucketPolicyStatus		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketPublicAccessBlock	Grants permission to retrieve the PublicAccessBlock configuration for an Amazon S3 bucket	Read	bucket*
GetBucketPublicAccessBlock		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketRequestPayment	Grants permission to return the request payment configuration for an Amazon S3 bucket	Read	bucket*
GetBucketRequestPayment		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketTagging	Grants permission to return the tag set associated with an Amazon S3 bucket	Read	bucket*
GetBucketTagging		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketVersioning	Grants permission to return the versioning state of an Amazon S3 bucket	Read	bucket*
GetBucketVersioning		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketWebsite	Grants permission to return the website configuration for an Amazon S3 bucket	Read	bucket*
GetBucketWebsite		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetDataAccess	Grants permission to get Access	Read	accessgrantsinstance*
GetDataAccess	Grants permission to get Access	Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetEncryptionConfiguration	Grants permission to return the default encryption configuration an Amazon S3 bucket	Read	bucket*
GetEncryptionConfiguration		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetIntelligentTieringConfiguration	Grants permission to get an or list all Amazon S3 Intelligent Tiering configuration in a S3 Bucket	Read	bucket*
GetIntelligentTieringConfiguration		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetInventoryConfiguration	Grants permission to return an inventory configuration from an Amazon S3 bucket, identified by the inventory configuration ID	Read	bucket*
GetInventoryConfiguration		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetJobTagging	Grants permission to return the tag set of an existing Amazon S3 Batch Operations job	Read	job*
GetJobTagging		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetLifecycleConfiguration	Grants permission to return the lifecycle configuration information set on an Amazon S3 bucket	Read	bucket*
GetLifecycleConfiguration		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetMetricsConfiguration	Grants permission to get a metrics configuration from an Amazon S3 bucket	Read	bucket*
GetMetricsConfiguration		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetMultiRegionAccessPoint	Grants permission to return configuration information about the specified Multi-Region Access Point	Read	multiregionaccesspoint*
GetMultiRegionAccessPoint		Read		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
GetMultiRegionAccessPointPolicy	Grants permission to return the access point policy associated with the specified Multi-Region Access Point	Read	multiregionaccesspoint*
GetMultiRegionAccessPointPolicy		Read		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
GetMultiRegionAccessPointPolicyStatus	Grants permission to return the policy status for a specific Multi-Region Access Point policy	Read	multiregionaccesspoint*
GetMultiRegionAccessPointPolicyStatus		Read		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
GetMultiRegionAccessPointRoutes	Grants permission to return the route configuration for a Multi-Region Access Point	Read	multiregionaccesspoint*
GetMultiRegionAccessPointRoutes		Read		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
GetObject	Grants permission to retrieve objects from Amazon S3	Read	object*
GetObject	Grants permission to retrieve objects from Amazon S3	Read		s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectAcl	Grants permission to return the access control list (ACL) of an object	Read	object*
GetObjectAcl		Read		s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectAttributes	Grants permission to retrieve attributes related to a specific object	Read	accesspoint*
			object*
				s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectLegalHold	Grants permission to get an object's current Legal Hold status	Read	object*
GetObjectLegalHold		Read		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectRetention	Grants permission to retrieve the retention settings for an object	Read	object*
GetObjectRetention		Read		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectTagging	Grants permission to return the tag set of an object	Read	object*
GetObjectTagging	Grants permission to return the tag set of an object	Read		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectTorrent	Grants permission to return torrent files from an Amazon S3 bucket	Read	object*
GetObjectTorrent		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectVersion	Grants permission to retrieve a specific version of an object	Read	object*
GetObjectVersion		Read		s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
GetObjectVersionAcl	Grants permission to return the access control list (ACL) of a specific object version	Read	object*
GetObjectVersionAcl		Read		s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
GetObjectVersionAttributes	Grants permission to retrieve attributes related to a specific version of an object	Read	object*
GetObjectVersionAttributes		Read		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
GetObjectVersionForReplication	Grants permission to replicate both unencrypted objects and objects encrypted with SSE-S3 or SSE-KMS	Read	object*
GetObjectVersionForReplication		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectVersionTagging	Grants permission to return the tag set for a specific version of the object	Read	object*
GetObjectVersionTagging		Read		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
GetObjectVersionTorrent	Grants permission to get Torrent files about a different version using the versionId subresource	Read	object*
GetObjectVersionTorrent		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
GetReplicationConfiguration	Grants permission to get the replication configuration information set on an Amazon S3 bucket	Read	bucket*
GetReplicationConfiguration		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetStorageLensConfiguration	Grants permission to get an Amazon S3 Storage Lens configuration	Read	storagelensconfiguration*
GetStorageLensConfiguration		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetStorageLensConfigurationTagging	Grants permission to get the tag set of an existing Amazon S3 Storage Lens configuration	Read	storagelensconfiguration*
GetStorageLensConfigurationTagging		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetStorageLensDashboard	Grants permission to get an Amazon S3 Storage Lens dashboard	Read	storagelensconfiguration*
GetStorageLensDashboard		Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetStorageLensGroup	Grants permission to get an Amazon S3 Storage Lens group	Read	storagelensgroup*
GetStorageLensGroup	Grants permission to get an Amazon S3 Storage Lens group	Read		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
InitiateReplication [permission only]	Grants permission to initiate the replication process by setting replication status of an object to pending	Write	object*
InitiateReplication [permission only]		Write		s3:ResourceAccount
ListAccessGrants	Grants permission to list Access Grant	List	accessgrantsinstance*
ListAccessGrants	Grants permission to list Access Grant	List		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
ListAccessGrantsInstances	Grants permission to List Access Grants Instances	List		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListAccessGrantsLocations	Grants permission to list Access Grants locations	List	accessgrantsinstance*
ListAccessGrantsLocations	Grants permission to list Access Grants locations	List		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
ListAccessPoints	Grants permission to list access points	List		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListAccessPointsForObjectLambda	Grants permission to list object lambda enabled accesspoints	List		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListAllMyBuckets	Grants permission to list all buckets owned by the authenticated sender of the request	List		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListBucket	Grants permission to list some or all of the objects in an Amazon S3 bucket (up to 1000)	List	bucket*
ListBucket		List		s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:delimiter s3:max-keys s3:prefix s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListBucketMultipartUploads	Grants permission to list in-progress multipart uploads	List	bucket*
ListBucketMultipartUploads	Grants permission to list in-progress multipart uploads	List		s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListBucketVersions	Grants permission to list metadata about all the versions of objects in an Amazon S3 bucket	List	bucket*
ListBucketVersions		List		s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:delimiter s3:max-keys s3:prefix s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListCallerAccessGrants	Grants permission to list caller's Access Grant	List	accessgrantsinstance*
ListCallerAccessGrants	Grants permission to list caller's Access Grant	List		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
ListJobs	Grants permission to list current jobs and jobs that have ended recently	List		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListMultiRegionAccessPoints	Grants permission to list Multi-Region Access Points	List		s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
ListMultipartUploadParts	Grants permission to list the parts that have been uploaded for a specific multipart upload	List	object*
ListMultipartUploadParts		List		s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListStorageLensConfigurations	Grants permission to list Amazon S3 Storage Lens configurations	List		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListStorageLensGroups	Grants permission to list S3 Storage Lens groups	List		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListTagsForResource	Grants permission to list the tags attached to the specified resource	List	accessgrant
			accessgrantsinstance
			accessgrantslocation
			storagelensgroup
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ObjectOwnerOverrideToBucketOwner	Grants permission to change replica ownership	Permissions management	object*
ObjectOwnerOverrideToBucketOwner	Grants permission to change replica ownership	Permissions management		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PauseReplication [permission only]	Grants permission to pause S3 Replication from target source buckets to destination buckets	Write	bucket*		S3:GetReplicationConfiguration S3:PutReplicationConfiguration
PauseReplication [permission only]		Write		s3:destinationRegion s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutAccelerateConfiguration	Grants permission to use the accelerate subresource to set the Transfer Acceleration state of an existing S3 bucket	Write	bucket*
PutAccelerateConfiguration		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutAccessGrantsInstanceResourcePolicy	Grants permission to put Access grants instance resource policy	Write	accessgrantsinstance*
PutAccessGrantsInstanceResourcePolicy		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
PutAccessPointConfigurationForObjectLambda	Grants permission to set the configuration of the object lambda enabled access point	Write	objectlambdaaccesspoint*
PutAccessPointConfigurationForObjectLambda		Write		s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutAccessPointPolicy	Grants permission to associate an access policy with a specified access point	Permissions management	accesspoint*
PutAccessPointPolicy		Permissions management		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutAccessPointPolicyForObjectLambda	Grants permission to associate an access policy with a specified object lambda enabled access point	Permissions management	objectlambdaaccesspoint*
PutAccessPointPolicyForObjectLambda		Permissions management		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutAccessPointPublicAccessBlock	Grants permission to associate public access block configurations with a specified access point, while creating a access point	Permissions management
PutAccountPublicAccessBlock	Grants permission to create or modify the PublicAccessBlock configuration for an AWS account	Permissions management		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutAnalyticsConfiguration	Grants permission to set an analytics configuration for the bucket, specified by the analytics configuration ID	Write	bucket*
PutAnalyticsConfiguration		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketAcl	Grants permission to set the permissions on an existing bucket using access control lists (ACLs)	Permissions management	bucket*
PutBucketAcl		Permissions management		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp
PutBucketCORS	Grants permission to set the CORS configuration for an Amazon S3 bucket	Write	bucket*
PutBucketCORS		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketLogging	Grants permission to set the logging parameters for an Amazon S3 bucket	Write	bucket*
PutBucketLogging		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketNotification	Grants permission to receive notifications when certain events happen in an Amazon S3 bucket	Write	bucket*
PutBucketNotification		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketObjectLockConfiguration	Grants permission to put Object Lock configuration on a specific bucket	Write	bucket*
PutBucketObjectLockConfiguration		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:TlsVersion s3:signatureversion
PutBucketOwnershipControls	Grants permission to add, replace or delete ownership controls on a bucket	Write	bucket*
PutBucketOwnershipControls		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketPolicy	Grants permission to add or replace a bucket policy on a bucket	Permissions management	bucket*
PutBucketPolicy		Permissions management		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketPublicAccessBlock	Grants permission to create or modify the PublicAccessBlock configuration for a specific Amazon S3 bucket	Permissions management	bucket*
PutBucketPublicAccessBlock		Permissions management		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketRequestPayment	Grants permission to set the request payment configuration of a bucket	Write	bucket*
PutBucketRequestPayment		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketTagging	Grants permission to add a set of tags to an existing Amazon S3 bucket	Tagging	bucket*
PutBucketTagging		Tagging		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketVersioning	Grants permission to set the versioning state of an existing Amazon S3 bucket	Write	bucket*
PutBucketVersioning		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketWebsite	Grants permission to set the configuration of the website that is specified in the website subresource	Write	bucket*
PutBucketWebsite		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutEncryptionConfiguration	Grants permission to set the encryption configuration for an Amazon S3 bucket	Write	bucket*
PutEncryptionConfiguration		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutIntelligentTieringConfiguration	Grants permission to create new or update or delete an existing Amazon S3 Intelligent Tiering configuration	Write	bucket*
PutIntelligentTieringConfiguration		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutInventoryConfiguration	Grants permission to add an inventory configuration to the bucket, identified by the inventory ID	Write	bucket*
PutInventoryConfiguration		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:InventoryAccessibleOptionalFields
PutJobTagging	Grants permission to replace tags on an existing Amazon S3 Batch Operations job	Tagging	job*
PutJobTagging		Tagging		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:ExistingJobPriority s3:ExistingJobOperation aws:TagKeys aws:RequestTag/${TagKey}
PutLifecycleConfiguration	Grants permission to create a new lifecycle configuration for the bucket or replace an existing lifecycle configuration	Write	bucket*
PutLifecycleConfiguration		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutMetricsConfiguration	Grants permission to set or update a metrics configuration for the CloudWatch request metrics from an Amazon S3 bucket	Write	bucket*
PutMetricsConfiguration		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutMultiRegionAccessPointPolicy	Grants permission to associate an access policy with a specified Multi-Region Access Point	Permissions management	multiregionaccesspoint*
PutMultiRegionAccessPointPolicy		Permissions management		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
PutObject	Grants permission to add an object to a bucket	Write	object*
PutObject	Grants permission to add an object to a bucket	Write		s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-copy-source s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-metadata-directive s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id s3:x-amz-server-side-encryption-customer-algorithm s3:x-amz-storage-class s3:x-amz-website-redirect-location s3:object-lock-mode s3:object-lock-retain-until-date s3:object-lock-remaining-retention-days s3:object-lock-legal-hold
PutObjectAcl	Grants permission to set the access control list (ACL) permissions for new or existing objects in an S3 bucket	Permissions management	object*
PutObjectAcl		Permissions management		s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-storage-class
PutObjectLegalHold	Grants permission to apply a Legal Hold configuration to the specified object	Write	object*
PutObjectLegalHold		Write		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:object-lock-legal-hold
PutObjectRetention	Grants permission to place an Object Retention configuration on an object	Write	object*
PutObjectRetention		Write		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:object-lock-mode s3:object-lock-retain-until-date s3:object-lock-remaining-retention-days
PutObjectTagging	Grants permission to set the supplied tag-set to an object that already exists in a bucket	Tagging	object*
PutObjectTagging		Tagging		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutObjectVersionAcl	Grants permission to use the acl subresource to set the access control list (ACL) permissions for an object that already exists in a bucket	Permissions management	object*
PutObjectVersionAcl		Permissions management		s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-storage-class
PutObjectVersionTagging	Grants permission to set the supplied tag-set for a specific version of an object	Tagging	object*
PutObjectVersionTagging		Tagging		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
PutReplicationConfiguration	Grants permission to create a new replication configuration or replace an existing one	Write	bucket*		iam:PassRole
PutReplicationConfiguration		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:isReplicationPauseRequest
PutStorageLensConfiguration	Grants permission to create or update an Amazon S3 Storage Lens configuration	Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:TagKeys aws:RequestTag/${TagKey}
PutStorageLensConfigurationTagging	Grants permission to put or replace tags on an existing Amazon S3 Storage Lens configuration	Tagging	storagelensconfiguration*
PutStorageLensConfigurationTagging		Tagging		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:TagKeys aws:RequestTag/${TagKey}
ReplicateDelete	Grants permission to replicate delete markers to the destination bucket	Write	object*
ReplicateDelete		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ReplicateObject	Grants permission to replicate objects and object tags to the destination bucket	Write	object*
ReplicateObject		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id s3:x-amz-server-side-encryption-customer-algorithm
ReplicateTags	Grants permission to replicate object tags to the destination bucket	Tagging	object*
ReplicateTags		Tagging		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
RestoreObject	Grants permission to restore an archived copy of an object back into Amazon S3	Write	object*
RestoreObject		Write		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
SubmitMultiRegionAccessPointRoutes	Grants permission to submit a route configuration update for a Multi-Region Access Point	Write	multiregionaccesspoint*
SubmitMultiRegionAccessPointRoutes		Write		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
TagResource	Grants permission to add tags to the specified resource	Tagging	accessgrant
			accessgrantsinstance
			accessgrantslocation
			storagelensgroup
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:TagKeys aws:RequestTag/${TagKey}
UntagResource	Grants permission to remove tags from the specified resource	Tagging	accessgrant
			accessgrantsinstance
			accessgrantslocation
			storagelensgroup
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:TagKeys
UpdateAccessGrantsLocation	Grants permission to update Access Grants location	Write	accessgrantslocation*
UpdateAccessGrantsLocation	Grants permission to update Access Grants location	Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
UpdateJobPriority	Grants permission to update the priority of an existing job	Write	job*
UpdateJobPriority	Grants permission to update the priority of an existing job	Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:RequestJobPriority s3:ExistingJobPriority s3:ExistingJobOperation
UpdateJobStatus	Grants permission to update the status for the specified job	Write	job*
UpdateJobStatus		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:ExistingJobPriority s3:ExistingJobOperation s3:JobSuspendedCause
UpdateStorageLensGroup	Grants permission to update an existing S3 Storage Lens group	Write	storagelensgroup*
UpdateStorageLensGroup		Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256

Resource types defined by Amazon S3

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
accesspoint	`arn:${Partition}:s3:${Region}:${Account}:accesspoint/${AccessPointName}`
bucket	`arn:${Partition}:s3:::${BucketName}`
object	`arn:${Partition}:s3:::${BucketName}/${ObjectName}`
job	`arn:${Partition}:s3:${Region}:${Account}:job/${JobId}`	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
storagelensconfiguration	`arn:${Partition}:s3:${Region}:${Account}:storage-lens/${ConfigId}`	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
storagelensgroup	`arn:${Partition}:s3:${Region}:${Account}:storage-lens-group/${Name}`	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
objectlambdaaccesspoint	`arn:${Partition}:s3-object-lambda:${Region}:${Account}:accesspoint/${AccessPointName}`
multiregionaccesspoint	`arn:${Partition}:s3::${Account}:accesspoint/${AccessPointAlias}`
multiregionaccesspointrequestarn	`arn:${Partition}:s3:us-west-2:${Account}:async-request/mrap/${Operation}/${Token}`
accessgrantsinstance	`arn:${Partition}:s3:${Region}:${Account}:access-grants/default`	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
accessgrantslocation	`arn:${Partition}:s3:${Region}:${Account}:access-grants/default/location/${Token}`	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
accessgrant	`arn:${Partition}:s3:${Region}:${Account}:access-grants/default/grant/${Token}`	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys

Condition keys for Amazon S3

Amazon S3 defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
s3:AccessGrantsInstanceArn	Filters access by access grants instance ARN	ARN
s3:AccessPointNetworkOrigin	Filters access by the network origin (Internet or VPC)	String
s3:DataAccessPointAccount	Filters access by the AWS Account ID that owns the access point	String
s3:DataAccessPointArn	Filters access by an access point Amazon Resource Name (ARN)	ARN
s3:ExistingJobOperation	Filters access by operation to updating the job priority	String
s3:ExistingJobPriority	Filters access by priority range to cancelling existing jobs	Numeric
s3:ExistingObjectTag/<key>	Filters access by existing object tag key and value	String
s3:InventoryAccessibleOptionalFields	Filters access by restricting which optional metadata fields a user can add when configuring S3 Inventory reports	ArrayOfString
s3:JobSuspendedCause	Filters access by a specific job suspended cause (for example, AWAITING_CONFIRMATION) to cancelling suspended jobs	String
s3:RequestJobOperation	Filters access by operation to creating jobs	String
s3:RequestJobPriority	Filters access by priority range to creating new jobs	Numeric
s3:RequestObjectTag/<key>	Filters access by the tag keys and values to be added to objects	String
s3:RequestObjectTagKeys	Filters access by the tag keys to be added to objects	ArrayOfString
s3:ResourceAccount	Filters access by the resource owner AWS account ID	String
s3:TlsVersion	Filters access by the TLS version used by the client	Numeric
s3:authType	Filters access by authentication method	String
s3:delimiter	Filters access by delimiter parameter	String
s3:destinationRegion	Filters access by a specific replication destination region for targeted buckets of the AWS FIS action aws:s3:bucket-pause-replication	String
s3:isReplicationPauseRequest	Filters access by request made via AWS FIS action aws:s3:bucket-pause-replication	Bool
s3:locationconstraint	Filters access by a specific Region	String
s3:max-keys	Filters access by maximum number of keys returned in a ListBucket request	Numeric
s3:object-lock-legal-hold	Filters access by object legal hold status	String
s3:object-lock-mode	Filters access by object retention mode (COMPLIANCE or GOVERNANCE)	String
s3:object-lock-remaining-retention-days	Filters access by remaining object retention days	Numeric
s3:object-lock-retain-until-date	Filters access by object retain-until date	Date
s3:prefix	Filters access by key name prefix	String
s3:signatureAge	Filters access by the age in milliseconds of the request signature	Numeric
s3:signatureversion	Filters access by the version of AWS Signature used on the request	String
s3:versionid	Filters access by a specific object version	String
s3:x-amz-acl	Filters access by canned ACL in the request's x-amz-acl header	String
s3:x-amz-content-sha256	Filters access by unsigned content in your bucket	String
s3:x-amz-copy-source	Filters access by copy source bucket, prefix, or object in the copy object requests	String
s3:x-amz-grant-full-control	Filters access by x-amz-grant-full-control (full control) header	String
s3:x-amz-grant-read	Filters access by x-amz-grant-read (read access) header	String
s3:x-amz-grant-read-acp	Filters access by the x-amz-grant-read-acp (read permissions for the ACL) header	String
s3:x-amz-grant-write	Filters access by the x-amz-grant-write (write access) header	String
s3:x-amz-grant-write-acp	Filters access by the x-amz-grant-write-acp (write permissions for the ACL) header	String
s3:x-amz-metadata-directive	Filters access by object metadata behavior (COPY or REPLACE) when objects are copied	String
s3:x-amz-object-ownership	Filters access by Object Ownership	String
s3:x-amz-server-side-encryption	Filters access by server-side encryption	String
s3:x-amz-server-side-encryption-aws-kms-key-id	Filters access by AWS KMS customer managed CMK for server-side encryption	ARN
s3:x-amz-server-side-encryption-customer-algorithm	Filters access by customer specified algorithm for server-side encryption	String
s3:x-amz-storage-class	Filters access by storage class	String
s3:x-amz-website-redirect-location	Filters access by a specific website redirect location for buckets that are configured as static websites	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions