Actions, Resources, and Condition Keys for Amazon S3 - AWS Identity and Access Management
Keywords: IAM,AWS Identity and Access Management,IAM user,user,IAM group,group,IAM role,role,permission policy,trust policy,policy,access key,password

Did this page help you? - Yes

Thanks for letting us know we're doing a good job!

If you've got a moment, please tell us what we did right so we can do more of it.

Did this page help you? - No

Thanks for letting us know this page needs work. We're sorry we let you down.

If you've got a moment, please tell us how we can make the documentation better.

# Actions, Resources, and Condition Keys for Amazon S3

Amazon S3 (service prefix: `s3` ) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

- Learn how to configure this service .

- View a list of the API operations available for this service .

- Learn how to secure this service and its resources by using IAM permission policies.

Topics

- Actions Defined by Amazon S3
- Resource Types Defined by Amazon S3
- Condition Keys for Amazon S3

## Actions Defined by Amazon S3

You can specify the following actions in the `Action` element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource Types column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the `Resource` element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see The Actions Table .

Actions | Description | Access Level | Resource Types (*required) | Condition Keys | Dependent Actions
--- | --- | --- | --- | --- | ---
AbortMultipartUpload | Aborts a multipart upload. | Write | object* |  |
| s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
BypassGovernanceRetention | Allows circumvention of governance-mode object retention settings | Permissions management | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authtype s3:signatureage s3:signatureversion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-copy-source s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-metadata-directive s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id s3:x-amz-storage-class s3:x-amz-website-redirect-location s3:object-lock-mode s3:object-lock-retain-until-date s3:object-lock-remaining-retention-days s3:object-lock-legal-hold |
CreateAccessPoint | Creates a new access point. | Write | accesspoint* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authtype s3:locationconstraint s3:signatureage s3:signatureversion s3:x-amz-acl s3:x-amz-content-sha256 |
CreateBucket | Creates a new bucket. | Write | bucket* |  |
| s3:authtype s3:locationconstraint s3:signatureage s3:signatureversion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp |
CreateJob | Creates a new Amazon S3 Batch Operations job. | Write |  | s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 s3:RequestJobPriority s3:RequestJobOperation |
DeleteAccessPoint | Deletes the access point named in the URI | Write | accesspoint* |  |
| s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
DeleteAccessPointPolicy | Delete the policy on a specified access point | Permissions management | accesspoint* |  |
| s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
DeleteBucket | Deletes the bucket named in the URI | Write | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
DeleteBucketPolicy | Delete the policy on a specified bucket | Permissions management | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
DeleteBucketWebsite | Removes the website configuration for a bucket. | Write | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
DeleteObject | Removes the null version (if there is one) of an object and inserts a delete marker, which becomes the current version of the object. | Write | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
DeleteObjectTagging | This implementation of the DELETE operation uses the tagging subresource to remove the entire tag set from the specified object. | Tagging | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
DeleteObjectVersion | To remove a specific version of a object, you must be the bucket owner and you must use the versionId subresource. | Write | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authtype s3:signatureage s3:signatureversion s3:versionid s3:x-amz-content-sha256 |
DeleteObjectVersionTagging | DELETE Object tagging (for a Specific Version of the Object) | Tagging | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authtype s3:signatureage s3:signatureversion s3:versionid s3:x-amz-content-sha256 |
DescribeJob | Retrieves the configuration parameters and status for an Amazon S3 batch operations job. | Read | job* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetAccelerateConfiguration | This implementation of the GET operation uses the accelerate subresource to return the Transfer Acceleration state of a bucket, which is either Enabled or Suspended. | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetAccessPoint | Retrieve access point metadata | Read |  | s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetAccessPointPolicy | Return the policy of a specified access point. | Read | accesspoint* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetAccessPointPolicyStatus | Retrieve the policy status for an specific access point's policy | Read | accesspoint* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetAccountPublicAccessBlock | Retrieve the PublicAccessBlock configuration for an AWS account | Read |  | s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetAnalyticsConfiguration | This implementation of the GET operation returns an analytics configuration (identified by the analytics configuration ID) from the bucket. | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetBucketAcl | Return the access control list (ACL) of a bucket. | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetBucketCORS | Returns the CORS configuration information set for the bucket. | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetBucketLocation | Return a bucket's region. | Read | bucket* |  |
GetBucketLogging | Return the logging status of a bucket and the permissions users have to view and modify that status. | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetBucketNotification | Return the notification configuration of a bucket. | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetBucketObjectLockConfiguration | GET Object Lock configuration for a specific bucket | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion |
GetBucketPolicy | Return the policy of a specified bucket. | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetBucketPolicyStatus | Retrieve the policy status for an specific S3 bucket, indicating whether the bucket is public. | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetBucketPublicAccessBlock | Retrieve the PublicAccessBlock configuration for a specific S3 bucket. | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetBucketRequestPayment | Return the request payment configuration of a bucket. | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetBucketTagging | Return the tag set associated with the bucket. | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetBucketVersioning | Return the versioning state of a bucket. | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetBucketWebsite | Returns the website configuration associated with a bucket. | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetEncryptionConfiguration | Returns the encryption configuration information set on the bucket. | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetInventoryConfiguration | This implementation of the GET operation returns an inventory configuration (identified by the inventory configuration ID) from the bucket. | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetLifecycleConfiguration | Returns the lifecycle configuration information set on the bucket. | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetMetricsConfiguration | Gets a metrics configuration for the CloudWatch request metrics (specified by the metrics configuration ID) from the bucket. Note that this doesn't include the daily storage metrics. | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetObject | Retrieves objects from Amazon S3. | Read | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetObjectAcl | Return the access control list (ACL) of an object. | Read | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetObjectLegalHold | GET Object Legal Hold for a specific object | Read | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetObjectRetention | GET Object Legal Hold for a specific object | Read | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetObjectTagging | This implementation of the GET operation returns the tags associated with an object. You send the GET request against the tagging subresource associated with the object. | Read | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetObjectTorrent | return torrent files from a bucket. | Read | object* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetObjectVersion | To return a different version, use the versionId subresource. | Read | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authtype s3:signatureage s3:signatureversion s3:versionid s3:x-amz-content-sha256 |
GetObjectVersionAcl | To return ACL information about a different version, use the versionId subresource. | Read | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authtype s3:signatureage s3:signatureversion s3:versionid s3:x-amz-content-sha256 |
GetObjectVersionForReplication | Permission exercised by S3 replication | Read | object* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
GetObjectVersionTagging | GET Object tagging (for a Specific Version of the Object) | Read | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authtype s3:signatureage s3:signatureversion s3:versionid s3:x-amz-content-sha256 |
GetObjectVersionTorrent | To return Torrent files about a different version, use the versionId subresource. | Read | object* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:versionid s3:x-amz-content-sha256 |
GetReplicationConfiguration | Returns the replication configuration information set on the bucket. | Read | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
ListAccessPoints | Lists access points. | Read |  | s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
ListAllMyBuckets | Returns a list of all buckets owned by the authenticated sender of the request. | List |  | s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
ListBucket | Returns some or all (up to 1000) of the objects in a bucket. | List | bucket* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authtype s3:delimiter s3:max-keys s3:prefix s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
ListBucketMultipartUploads | Lists in-progress multipart uploads. | Read | bucket* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
ListBucketVersions | Use the versions subresource to list metadata about all of the versions of objects in a bucket. | Read | bucket* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authtype s3:delimiter s3:max-keys s3:prefix s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
ListJobs | Lists current jobs and jobs that have ended recently. | Read |  | s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
ListMultipartUploadParts | Lists the parts that have been uploaded for a specific multipart upload. | Read | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
ObjectOwnerOverrideToBucketOwner | Permission exercised by S3 replication | Permissions management | object* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutAccelerateConfiguration | This implementation of the PUT operation uses the accelerate subresource to set the Transfer Acceleration state of an existing bucket. | Write | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutAccessPointPolicy | Add to or replace a data policy on a access point. | Permissions management | accesspoint* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutAccountPublicAccessBlock | Create or modify the PublicAccessBlock configuration for an AWS account. | Permissions management |  | s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutAnalyticsConfiguration | This implementation of the PUT operation adds an analytics configuration (identified by the analytics ID) to the bucket. You can have up to 1,000 analytics configurations per bucket. | Write | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutBucketAcl | Set the permissions on an existing bucket using access control lists (ACL). | Permissions management | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp |
PutBucketCORS | Sets the CORS configuration for your bucket. | Write | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutBucketLogging | Set the logging parameters for a bucket. | Write | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutBucketNotification | Enables you to receive notifications when certain events happen in your bucket. | Write | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutBucketObjectLockConfiguration | PUT Object Lock configuration on a specific bucket | Write | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion |
PutBucketPolicy | Add to or replace a policy on a bucket. | Permissions management | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutBucketPublicAccessBlock | Create or modify the PublicAccessBlock configuration for an specific S3 bucket. | Permissions management | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutBucketRequestPayment | Set the request payment configuration of a bucket. | Write | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutBucketTagging | Add a set of tags to an existing bucket. | Tagging | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutBucketVersioning | Set the versioning state of an existing bucket. | Write | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutBucketWebsite | Sets the configuration of the website that is specified in the website subresource. | Write | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutEncryptionConfiguration | Sets the encryption configuration for the bucket. | Write | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutInventoryConfiguration | This implementation of the PUT operation adds an inventory configuration (identified by the inventory ID) to the bucket. You can have up to 1,000 inventory configurations per bucket. | Write | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutLifecycleConfiguration | Creates a new lifecycle configuration for the bucket or replaces an existing lifecycle configuration. | Write | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutMetricsConfiguration | Sets or updates a metrics configuration for the CloudWatch request metrics (specified by the metrics configuration ID) from the bucket. | Write | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutObject | Adds an object to a bucket. | Write | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authtype s3:signatureage s3:signatureversion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-copy-source s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-metadata-directive s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id s3:x-amz-storage-class s3:x-amz-website-redirect-location s3:object-lock-mode s3:object-lock-retain-until-date s3:object-lock-remaining-retention-days s3:object-lock-legal-hold |
PutObjectAcl | Set the access control list (ACL) permissions for an object that already exists in a bucket. | Permissions management | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authtype s3:signatureage s3:signatureversion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-storage-class |
PutObjectLegalHold | PUT Object Legal Hold on a specific object | Write | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 s3:object-lock-legal-hold |
PutObjectRetention | PUT Object Retention on a specific object | Write | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 s3:object-lock-mode s3:object-lock-retain-until-date s3:object-lock-remaining-retention-days |
PutObjectTagging | This implementation of the PUT operation uses the tagging subresource to add a set of tags to an existing object. | Tagging | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
PutObjectVersionAcl | The ACL of an object is set at the object version level. | Permissions management | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:authtype s3:signatureage s3:signatureversion s3:versionid s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-storage-class |
PutObjectVersionTagging | PUT Object tagging (for a Specific Version of the Object) | Tagging | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:ExistingObjectTag/<key> s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authtype s3:signatureage s3:signatureversion s3:versionid s3:x-amz-content-sha256 |
PutReplicationConfiguration | In a versioning-enabled bucket, this operation creates a new replication configuration (or replaces an existing one, if present). | Write | bucket* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
ReplicateDelete | Permission exercised by S3 replication | Write | object* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
ReplicateObject | Permission exercised by S3 replication | Write | object* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id |
ReplicateTags | Permission exercised by S3 replication | Tagging | object* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
RestoreObject | Restores a temporary copy of an archived object. | Write | object* |  |
| s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 |
UpdateJobPriority | Updates an existing job's priority. | Write | job* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 s3:RequestJobPriority s3:ExistingJobPriority s3:ExistingJobOperation |
UpdateJobStatus | Updates the status for the specified job. | Write | job* |  |
| s3:authtype s3:signatureage s3:signatureversion s3:x-amz-content-sha256 s3:ExistingJobPriority s3:ExistingJobOperation s3:JobSuspendedCause |

## Resource Types Defined by Amazon S3

The following resource types are defined by this service and can be used in the `Resource` element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see The Resource Types Table .

Resource Types | ARN | Condition Keys
--- | --- | ---
accesspoint | `arn:$ { Partition}:s3:$ { Region}:$ { Account}:accesspoint/$ { AccessPointName}` |
bucket | `arn:$ { Partition}:s3:::$ { BucketName}` |
object | `arn:$ { Partition}:s3:::$ { BucketName}/$ { ObjectName}` |
job | `arn:$ { Partition}:s3:$ { Region}:$ { Account}:job/$ { JobId}` |

## Condition Keys for Amazon S3

Amazon S3 defines the following condition keys that can be used in the `Condition` element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see The Condition Keys Table .

To view the global condition keys that are available to all services, see Available Global Condition Keys in the IAM Policy Reference .

Condition Keys | Description | Type
--- | --- | ---
s3:AccessPointNetworkOrigin | The network type from which traffic may be received by the access point involved in the request | String
s3:DataAccessPointAccount | The AWS Account ID of the account that owns the data operations access point involved in the request | String
s3:DataAccessPointArn | The ARN of the data operations access point involved in the request | String
s3:ExistingJobOperation |  | String
s3:ExistingJobPriority |  | Numeric
s3:ExistingObjectTag/<key> | Enables you to verify that an existing object tag has the specific tag key and value. | String
s3:JobSuspendedCause |  | String
s3:LocationConstraint | Enables you to restrict users to creating buckets in only a specific region. | String
s3:RequestJobOperation |  | String
s3:RequestJobPriority |  | Numeric
s3:RequestObjectTag/<key> | Restrict the tag keys and values that you want to allow on objects. | String
s3:RequestObjectTagKeys | restrict the tag keys that you want to allow on objects. | String
s3:VersionId | Enables you to limit the permission for the s3:PutObjectVersionTagging action to a specific object version. | String
s3:authtype |  | String
s3:delimiter | Enables you to require the user to specify the delimiter parameter in the GET Bucket Object versions request. | String
s3:locationconstraint | Enables you to restrict the user to creating a bucket in only a specific region. | String
s3:max-keys | Enables you to limit the number of keys Amazon S3 returns in response to ListBucket requests by requiring the user to specify the max-keys parameter. | Numeric
s3:object-lock-legal-hold | Enables enforcement of the specified object legal hold status | String
s3:object-lock-mode | Enables enforcement of the specified object retention mode | String
s3:object-lock-remaining-retention-days | Enables enforcement of an object relative to the remaining retention days | String
s3:object-lock-retain-until-date | Enables enforcement of a specific retain-until-date | String
s3:prefix | Enables you to limit the response of the ListBucket API to key names with specific prefix. | String
s3:signatureage |  | Numeric
s3:signatureversion |  | String
s3:versionid |  | String
s3:x-amz-acl | Enables you to require specific access permissions when uploading an object. | String
s3:x-amz-content-sha256 |  | String
s3:x-amz-copy-source | Enables you to restrict the copy source to a specific bucket, a specific folder in the bucket, or a specific object in a bucket. | String
s3:x-amz-grant-full-control |  | String
s3:x-amz-grant-read |  | String
s3:x-amz-grant-read-acp |  | String
s3:x-amz-grant-write |  | String
s3:x-amz-grant-write-acp |  | String
s3:x-amz-metadata-directive | Enables you to enforce certain behavior (COPY vs. REPLACE) when objects are uploaded. | String
s3:x-amz-server-side-encryption | Enables you to require the user to specify this header in the request to ensure that objects the user uploads are encrypted when they are saved. | String
s3:x-amz-server-side-encryption-aws-kms-key-id |  | String
s3:x-amz-storage-class |  | String
s3:x-amz-website-redirect-location |  | String