# s3-bucket-blacklisted-actions-prohibited
<a name="s3-bucket-blacklisted-actions-prohibited"></a>

Checks if an Amazon Simple Storage Service (Amazon S3) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other Amazon accounts. For example, the rule checks that the Amazon S3 bucket policy does not allow another Amazon account to perform any `s3:GetBucket*` actions and `s3:DeleteObject` on any object in the bucket. The rule is NON\$1COMPLIANT if any blocklisted actions are allowed by the Amazon S3 bucket policy.

**Note**  
The rule will only check for entities in the Principal property and does not take into account any conditionals under the Condition property in a policy



**Identifier:** S3\$1BUCKET\$1BLACKLISTED\$1ACTIONS\$1PROHIBITED

**Resource Types:** AWS::S3::Bucket

**Trigger type:** Configuration changes

**Amazon Web Services Region:** All supported Amazon regions

**Parameters:**

blacklistedActionPatternType: CSV  
Comma-separated list of blacklisted action patterns, for example, s3:GetBucket\$1 and s3:DeleteObject.

## Amazon CloudFormation template
<a name="w2aac20c16c17b7e1383c21"></a>

To create Amazon Config managed rules with Amazon CloudFormation templates, see [Creating Amazon Config Managed Rules With Amazon CloudFormation Templates](aws-config-managed-rules-cloudformation-templates.md).