You can use bucket policies to manage permissions and access to Object Storage. When compared to access control lists (ACLs), bucket policies can only be applied across an entire bucket, and not to its individual objects. But, bucket policies offer you more control over the types of permissions you can grant to a user.

Apply a bucket policy with s3cmd

These sections quickly walk you through how to create and apply a bucket policy.

Before you begin

You need an Object Storage bucket:

• Create a new bucket if you don't have one yet.
• View your buckets to store the Name of the target bucket.

Step 1: Create the policy

You need to create a policy file and save it to your local machine as policy.json. Here's an example policy that rejects all S3 API requests unless they originate from the specified IP address:

{
 "Version": "2012-10-17",
 "Statement": [
   {
     "Effect": "Deny",
     "Principal": "*",
     "Action": "s3:*",
     "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*",
     "Condition": {
       "NotIpAddress": {
         "aws:SourceIp": "192.0.2.1/32"
       }
     }
   }
 ]
}

Replace YOUR_BUCKET_NAME with the name of your bucket and update the IP address CIDR appropriately according to your needs. If you want to restrict the bucket to a single IP address, use /32. (This is covered in more detail in Allow or deny access from a specific IP address.

Step 2: Check for an existing policy

Make sure you don't already have a policy for your target bucket. Run this command, replacing YOUR_BUCKET_NAME with the bucket's name:

s3cmd setpolicy policy.json s3://YOUR_BUCKET_NAME

If you do have an existing policy, and you want to keep its contents, download that existing policy (using s3cmd info) and merge its contents into policy.json before you continue.

🚧

If you're using limited access keys, you need to merge an existing policy with your new policy to avoid impacting the enforcement of these limited access keys. See Access keys for Object Storage for more details.

Step 3: Upload and validate the policy

Get your policy added to your bucket and check on its contents.

1. Run this command, replacing YOUR_BUCKET_NAME with the name of your bucket to upload your new policy:

   s3cmd setpolicy policy.json s3://YOUR_BUCKET_NAME

2. Run this command, replacing YOUR_BUCKET_NAME with the name of your bucket to validate the policy:

   s3cmd info s3://YOUR_BUCKET_NAME

   👍

   See Use s3cmd with Object Storage for more details on the s3cmd commands covered here.

The fields in a policy

Bucket policies are JSON-formatted, using this structure:

{
 "Version": "2026-10-17",
 "Statement": [{
   "Effect": ...,
   "Principal": ...,
   "Action": ...,
   "Resource": ...
 }]
}

This file consists of these fields:

• Version. This is a string that represents the date the policy was last updated
• Statement. This is one or more arrays, which define the actual policies you're using. These arrays include the Effect, Principal, Action, Resource, and Condition fields.

The Statement fields

"Effect":"Allow"

Bucket policy examples

These sections offer some examples of pre-formatted bucket policies for specific scenarios.

{
 "Version": "2012-10-17",
 "Statement": [{
   "Effect": "Allow",
   "Principal": "*",
   "Action": [
     "s3:GetObject",
     "s3:ListBucket"
   ],
   "Resource": [
     "arn:aws:s3:::bucket-example",
     "arn:aws:s3:::bucket-example/*"
   ]
 }]
}