> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.zata.prathamchopde.site/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.zata.prathamchopde.site/_mcp/server.

# What bucket policies support

Zata supports a subset of the AWS S3 bucket policy language. Use this page when you write a policy as JSON and apply it with an S3 tool. The easiest and safest way is still the [Policies page](/access/bucket-policies) in the Zata console, which builds a valid policy for you.

Only the bucket owner can set, read or delete a bucket policy. Sub-users cannot.

## Example

This policy lets one user list the `reports/` folder of `my-bucket` and download files from it:

**`policy.json`**

```json policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": ["arn:aws:iam:::user/YOUR_USER_ID"] },
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::my-bucket/reports/*"]
    },
    {
      "Effect": "Allow",
      "Principal": { "AWS": ["arn:aws:iam:::user/YOUR_USER_ID"] },
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::my-bucket"],
      "Condition": { "StringLike": { "s3:prefix": ["reports/*"] } }
    }
  ]
}
```

Apply, check and remove it with the [AWS CLI](/connect/command-line/aws-cli) (profile `zata`):

```bash
aws s3api put-bucket-policy --bucket my-bucket --policy file://policy.json --profile zata
aws s3api get-bucket-policy --bucket my-bucket --profile zata
aws s3api delete-bucket-policy --bucket my-bucket --profile zata
```

If a policy is refused, the error message shows which part is wrong. Remove one unsupported part at a time and try again.

## Principals

| Who                       | `Principal`                                      |
| ------------------------- | ------------------------------------------------ |
| Anyone (public)           | `"*"`                                            |
| One Zata user or sub-user | `{ "AWS": ["arn:aws:iam:::user/YOUR_USER_ID"] }` |

Zata uses its own user IDs, not 12-digit AWS account IDs. The simplest way to get a sub-user's principal right is to create a policy for it on the **Policies** page, then read it back with `get-bucket-policy`.

## Actions

These are the actions you can grant in a Zata bucket policy, written as `s3:<Action>`:

| Group       | Actions                                                                                                                                                                                                                                                 |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Files       | `GetObject`, `GetObjectVersion`, `PutObject`, `DeleteObject`, `DeleteObjectVersion`, `GetObjectAcl`, `PutObjectAcl`, `GetObjectTagging`, `PutObjectTagging`, `DeleteObjectTagging`, `AbortMultipartUpload`, `ListMultipartUploadParts`, `RestoreObject` |
| Bucket      | `ListBucket`, `ListBucketVersions`, `ListBucketMultipartUploads`, `GetBucketVersioning`, `PutBucketVersioning`, `GetBucketTagging`, `PutBucketTagging`                                                                                                  |
| Object Lock | `PutObjectRetention`, `GetObjectRetention`, `PutObjectLegalHold`, `GetObjectLegalHold`, `BypassGovernanceRetention`                                                                                                                                     |

* Sub-users can never be given `PutObjectAcl`, `PutObjectTagging`, `PutBucketVersioning` or `PutBucketTagging`.
* The Object Lock actions are not on the Policies page, and sub-users cannot request them. See [Object Lock](/buckets/object-lock/overview).
* Your own (root) keys can already do everything in your account. Policies are only for giving access to others.

Any other S3 action is not offered in Zata policies.

## Condition keys

**General keys** (all requests): `aws:CurrentTime`, `aws:EpochTime`, `aws:PrincipalType`, `aws:Referer`, `aws:SecureTransport`, `aws:SourceIp`, `aws:UserAgent`, `aws:username`.

**S3 keys**:

| Condition key                                                                      | Used with                                                       |
| ---------------------------------------------------------------------------------- | --------------------------------------------------------------- |
| `s3:prefix`, `s3:delimiter`, `s3:max-keys`                                         | `ListBucket`, `ListBucketVersions`                              |
| `s3:x-amz-acl`, `s3:x-amz-grant-<perm>`                                            | `PutObject`, `PutObjectAcl`                                     |
| `s3:x-amz-copy-source`, `s3:x-amz-metadata-directive`, `s3:RequestObjectTag/<key>` | `PutObject`                                                     |
| `s3:ExistingObjectTag/<key>`                                                       | `GetObject`, `GetObjectVersion`, `GetObjectAcl`, object tagging |

To limit access by IP address, use the `aws:SourceIp` key with the `IpAddress` or `NotIpAddress` condition operator. These are condition operators, not actions.

## Not supported

* IAM user, group and role policies. Zata has bucket policies only. Giving access to a whole account gives it to every user in that account.
* AWS account IDs in `Principal`.
* Policy variables such as `${aws:username}` in `Resource` or conditions.
* Condition keys not listed above, for example `aws:SourceArn`, `aws:SourceAccount`, `aws:SourceVpc`, `aws:SourceVpce`, `aws:PrincipalTag/*`, `aws:RequestTag/*`, `aws:MultiFactorAuthPresent`.
* Actions not listed above, for example `s3:PutBucketOwnershipControls`, `s3:PutEncryptionConfiguration`, `s3:GetObjectAttributes`, `s3:PutInventoryConfiguration`.

For other access errors, see [Access denied](/help/troubleshooting/access-denied).