AWS S3 Bucket Policy Generator
Generate secure AWS S3 bucket policies for HTTPS enforcement, CloudFront OAC, and IP whitelisting — entirely on this device.
Generate JSON-compliant, least-privilege AWS S3 bucket policies with HTTPS enforcement, CloudFront OAC, VPC endpoint restrictions, and IP whitelisting.
Policy Statements (1)
Generated S3 Bucket Policy JSON
aws s3api put-bucket-policy --bucket my-app-production-assets --policy '{"Version":"2012-10-17","Statement":[{"Sid":"EnforceTLSRequestsOnly","Effect":"Deny","Principal":"*","Action":"s3:*","Resource":["arn:aws:s3:::my-app-production-assets","arn:aws:s3:::my-app-production-assets/*"],"Condition":{"Bool":{"aws:SecureTransport":"false"}}}]}'Do it offline:$
How to use it
- Enter your target Amazon S3 bucket name (e.g. my-production-assets).
- Select an architecture preset (HTTPS enforcement, Public Read, CloudFront OAC, IP whitelist, or VPC endpoint) or build custom statements.
- Configure statement parameters: Effect (Allow/Deny), Principal (AWS account, IAM role, or CloudFront service principal), and S3 actions.
- Review automated security analysis warnings alerting on unsafe public write access or missing HTTPS enforcement.
- Copy the valid JSON policy document or the ready-to-run aws s3api put-bucket-policy CLI command.
Generate secure, JSON-compliant AWS S3 bucket policies. Configure HTTPS/TLS enforcement, CloudFront Origin Access Control (OAC), IP address whitelisting, and VPC endpoint restrictions with automated security linting.
How it works
Amazon S3 bucket policies are resource-based IAM policies attached directly to a bucket that govern access to the bucket and its objects.
Statements define Effect (Allow/Deny), Principal (who is granted or denied access), Action (e.g. s3:GetObject, s3:PutObject), Resource (ARN paths), and optional Condition blocks.
An explicit Deny statement always overrides any conflicting Allow statement across both IAM identity policies and bucket policies.
CloudFront Origin Access Control (OAC) authenticates requests using AWS SigV4 signatures, preventing users from bypassing the CDN to access the S3 origin directly.
Examples
Every example on this page is executed against the same engine that powers the tool, on every build.
Gotchas worth knowing
Common errors
FAQ
Why should every S3 bucket have an HTTPS enforcement policy?
By default, S3 buckets accept both unencrypted HTTP and encrypted HTTPS requests. Adding a policy statement with Effect: Deny when Condition { Bool: { 'aws:SecureTransport': 'false' } } ensures that all unencrypted HTTP traffic is rejected at the API layer, satisfying compliance standards like PCI-DSS and SOC 2.
What is the difference between CloudFront OAC and OAI?
Origin Access Identity (OAI) is the legacy CloudFront access mechanism that only supports S3 GET/HEAD requests and lacks SSE-KMS support. Origin Access Control (OAC) is the modern replacement supporting all HTTP methods, SSE-KMS encryption, dynamic bucket regions, and granular SigV4 request verification.
What is the difference between arn:aws:s3:::bucket and arn:aws:s3:::bucket/*?
arn:aws:s3:::bucket refers to the bucket container itself (used for bucket-level actions like s3:ListBucket and s3:GetBucketLocation). arn:aws:s3:::bucket/* refers to the objects stored inside the bucket (required for object-level actions like s3:GetObject and s3:PutObject).