Bucket Policies

VersityGW supports bucket policies that follow the same JSON structure as AWS S3 bucket policies. The key difference is how principals are specified: instead of AWS IAM ARNs, you use the user account names configured in VersityGW's IAM backend.

Overview

A bucket policy is a resource-based access control policy attached to a bucket. It defines which users can perform which S3 actions on the bucket and its objects. Bucket policies complement user-level permissions and are evaluated alongside them.

Bucket policies in VersityGW support the standard S3 policy elements:

Element	Description
Version	Policy language version. Use "2012-10-17".
Statement	Array of permission statements.
Sid	Optional statement identifier.
Effect	"Allow" or "Deny".
Principal	User account name(s) the statement applies to.
Action	S3 action(s) to allow or deny.
Resource	The bucket or object ARN(s) the policy applies to.
Condition	Optional conditions for the policy to apply.

Principals

In AWS S3, principals are specified as IAM ARNs such as "arn:aws:iam::123456789012:user/alice". In VersityGW, principals are simply the user account names as defined in your IAM configuration — for example, "user1" or "alice".

You can specify a single principal as a string or multiple principals as an array:

"Principal": "user1"

"Principal": ["user1", "user2"]

To grant access to all users (including unauthenticated requests), use the wildcard:

"Principal": "*"

Resources

Resources are specified as S3 ARNs. Use the bucket name without an account ID or region:

• Bucket-level actions (e.g., s3:ListBucket): "arn:aws:s3:::mybucket"
• Object-level actions (e.g., s3:GetObject): "arn:aws:s3:::mybucket/*"

You can target a specific prefix within a bucket:

"Resource": "arn:aws:s3:::mybucket/logs/*"

Example Policy

The following policy grants user1 and user2 read-only access to mybucket, including the ability to list the bucket and its multipart uploads and to read objects and their metadata:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadOnlyS3Access",
      "Effect": "Allow",
      "Principal": [
        "user1",
        "user2"
      ],
      "Action": [
        "s3:GetObject",
        "s3:GetObjectAttributes",
        "s3:GetObjectRetention",
        "s3:GetObjectTagging",
        "s3:ListBucket",
        "s3:ListBucketMultipartUploads",
        "s3:ListMultipartUploadParts"
      ],
      "Resource": [
        "arn:aws:s3:::mybucket",
        "arn:aws:s3:::mybucket/*"
      ]
    }
  ]
}

Note: The Resource array should include both the bucket ARN (for bucket-level actions such as s3:ListBucket) and the object wildcard ARN (for object-level actions such as s3:GetObject). A policy that only lists arn:aws:s3:::mybucket/* will not permit s3:ListBucket.

Setting a Bucket Policy with the AWS CLI

Save your policy to a JSON file (e.g., policy.json), then use the put-bucket-policy command. Point the CLI at your VersityGW endpoint using --endpoint-url.

aws s3api put-bucket-policy \
  --endpoint-url https://your-versitygw-host:7070 \
  --bucket mybucket \
  --policy file://policy.json

Retrieving the Current Policy

aws s3api get-bucket-policy \
  --endpoint-url https://your-versitygw-host:7070 \
  --bucket mybucket

Deleting the Policy

aws s3api delete-bucket-policy \
  --endpoint-url https://your-versitygw-host:7070 \
  --bucket mybucket

Deny Example

You can explicitly deny access to a specific user regardless of other permissions. The following policy denies baduser all access to the bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyBadUser",
      "Effect": "Deny",
      "Principal": "baduser",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::mybucket",
        "arn:aws:s3:::mybucket/*"
      ]
    }
  ]
}

Note: An explicit Deny always overrides an Allow, even if another statement grants the user access.

Supported Actions

VersityGW supports the standard S3 policy actions. Common examples include:

Action	Description
s3:GetObject	Download objects
s3:PutObject	Upload objects
s3:DeleteObject	Delete objects
s3:ListBucket	List objects in a bucket
s3:GetBucketPolicy	Read the bucket policy
s3:PutBucketPolicy	Write the bucket policy
s3:DeleteBucketPolicy	Delete the bucket policy
s3:GetObjectTagging	Read object tags
s3:PutObjectTagging	Write object tags
s3:GetObjectRetention	Read object retention settings
s3:PutObjectRetention	Write object retention settings
s3:ListBucketMultipartUploads	List in-progress multipart uploads
s3:ListMultipartUploadParts	List parts of a multipart upload
s3:AbortMultipartUpload	Abort a multipart upload
s3:*	All S3 actions

See Also

• Multi-Tenant/IAM
• Differences from AWS S3