Using bucket policies to control access to S3

As we covered previously, Amazon S3 bucket policies are resource-based policies as the policy is directly attached to the resource itself—in this case, the bucket. If you remember, resource-based policies have to have the additional parameter of Principal within the policy, so it knows which identity the permissions apply to.

We will see how to create a policy for an S3 bucket and how to apply this policy to a bucket. For this example, we have a bucket called awsbucketpolicy and we will add a bucket policy to this allowing user Lisa in a different AWS account to access the bucket. Now, previously, we looked at using roles to create cross-account access; however, for S3 resources it's also possible to emulate this cross-account access by using resource-based policies (bucket policies) and an identity-based policy attached to Lisa in the second account.

So, first, let’s create the bucket policy:

1. Once you have navigated to...