> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.zata.prathamchopde.site/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.zata.prathamchopde.site/_mcp/server.

# Bucket policies

A bucket policy is a set of rules that says **who** can do **which actions** on a bucket or on some of its folders. On the **Policies** page you build these rules with a short wizard — Zata writes the policy for you. Use it to give a [sub-user](/sub-users/overview) exactly the access it needs, or to open part of a bucket to the public.

If you prefer to write the policy JSON yourself with an S3 tool, see [What bucket policies support](/access/policy-support).

## Create a policy

#### Start the wizard

In the sidebar, open **Policies** and select **Create Policy**.

![The Access Policies page with Create Policy and Refresh buttons, filters, and an empty policy list](/_fern-img/bd451d87fa0a7db1187a459ff60c2eab37478212b4c1b761ef76e1e943338750.webp)

#### Grantee: choose who gets access

Under **Who should get access?**, choose:

* **Public** — anyone on the internet, with no sign-in. Then choose the **Region** of the bucket.
* **Subuser** — one of your sub-users. Choose it under **Select subuser**. Only active sub-users are listed, and you can only pick buckets in the sub-user's own regions.

Select **Next**.

![The Grantee step with Public and Subuser options and the Region dropdown showing Indore and Mumbai](/_fern-img/7366feb90b44e3082e70822c815bd6d8625d46db843d46c00fa66427cfa4c9a8.webp)

#### Bucket and scope: choose where it applies

Under **Select bucket**, pick the bucket. Under **Access scope**, choose:

* **Entire bucket** — the rule covers every file.
* **Specific folders** — type a folder path (end it with `/`, for example `reports/2026/`) and select **Add**. Add as many folders as you need. If a folder does not exist yet, Zata offers to create it.

![The Bucket and scope step with a bucket selected and the Entire bucket and Specific folders options](/_fern-img/0dd7bdf6b3a7941fa8f525908be23e6949d91f9c2658a268a8ae54078690b2a2.webp)

#### Permissions: choose the actions

Tick the actions to include, under **Object operations** and **Bucket operations**. The full list is in [Actions you can choose](#actions-you-can-choose).

![The Permissions step with Object operations checkboxes such as Download files and Upload files](/_fern-img/7f4f7c8b9bd69c5ffb05435b25a3956b5f972c5413c64bbb46cb78cfaeae103b.webp)

#### Review and create

Check the bucket, region, grantee and actions. Choose the **Effect**:

* **Allow** grants the selected actions.
* **Deny** blocks them, even if something else (such as an ACL) allows them.

Enter a **Policy name** (up to 120 characters). A name is required when your actions do not match one of the ready-made sets. Then select **Create access policy**.

![The Review step showing bucket, region, grantee, effect, selected actions, scope details and a policy name field](/_fern-img/97185f6bcf4e02e8e580d375d751a1f200c9428a0df3c7ff481e6251fca0e7e9.webp)

If a policy already exists for the same bucket and grantee, the wizard ticks its current actions for you, and the button changes to **Update existing policy** — so you edit that policy instead of creating a duplicate.

## Actions you can choose

| Console name                 | S3 action                       | Public | Sub-user |
| ---------------------------- | ------------------------------- | ------ | -------- |
| **Download files**           | `s3:GetObject`                  | ✓      | ✓        |
| **Download file versions**   | `s3:GetObjectVersion`           | ✓      | ✓        |
| **Upload files**             | `s3:PutObject`                  | ✓      | ✓        |
| **Delete files**             | `s3:DeleteObject`               | —      | ✓        |
| **Delete file versions**     | `s3:DeleteObjectVersion`        | —      | ✓        |
| **View file permissions**    | `s3:GetObjectAcl`               | ✓      | ✓        |
| **Change file permissions**  | `s3:PutObjectAcl`               | —      | —        |
| **View file tags**           | `s3:GetObjectTagging`           | ✓      | ✓        |
| **Add/edit file tags**       | `s3:PutObjectTagging`           | ✓      | —        |
| **Remove file tags**         | `s3:DeleteObjectTagging`        | ✓      | ✓        |
| **Cancel uploads**           | `s3:AbortMultipartUpload`       | ✓      | ✓        |
| **View upload parts**        | `s3:ListMultipartUploadParts`   | ✓      | ✓        |
| **Restore archived files**   | `s3:RestoreObject`              | ✓      | ✓        |
| **List files**               | `s3:ListBucket`                 | ✓      | ✓        |
| **List file versions**       | `s3:ListBucketVersions`         | ✓      | ✓        |
| **List in-progress uploads** | `s3:ListBucketMultipartUploads` | ✓      | ✓        |
| **View versioning status**   | `s3:GetBucketVersioning`        | ✓      | ✓        |
| **Change versioning**        | `s3:PutBucketVersioning`        | ✓      | —        |
| **View bucket tags**         | `s3:GetBucketTagging`           | ✓      | ✓        |
| **Manage bucket tags**       | `s3:PutBucketTagging`           | ✓      | —        |

* **Public** policies only offer non-destructive actions: no delete and no permission changes.
* **Sub-users** can never get **Change file permissions**, **Add/edit file tags**, **Change versioning** or **Manage bucket tags**.
* With **Specific folders**, the bucket-wide settings (**View versioning status**, **Change versioning**, **View bucket tags**, **Manage bucket tags**) are not offered, and the listing actions only list inside the chosen folders.

> **Warning**
>
> **Upload files** for **Public** lets anyone on the internet add and overwrite files in that bucket or folder, and you pay for what they store. Use it only when you really mean it.

## Manage policies

Your policies appear as cards on the **Policies** page, grouped by bucket. Use the filters to find one by bucket, name or action, or by status (**Active**, **Suspended**, **Expired**).

![The Access Policies list showing a new Active policy card with its bucket, preset, scope and number of actions](/_fern-img/ecff6d51cdfcf0c9e6b894938752d3e2e7230412d1bb9499b2777cdf6c68bd72.webp)

Select a card to see its effect, scope, grantee, folders and actions. From there you can:

* **Edit** — change the scope, effect, actions or name, then **Save changes**.
* **Suspend** — turn the policy off for now without deleting it. **Resume** turns it back on.
* **Delete** — remove the policy for good.

Sub-users can ask you for more actions on a policy they already have. Their requests appear under **Policy Requests** on the **Policies** page — see [Sub-user policies and requests](/sub-users/policies).

## Next steps

* [What bucket policies support](/access/policy-support) — write a policy yourself with the S3 API
* [Access control (ACL)](/access/access-control) — public buckets and files