Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon S3

Amazon S3 (service prefix: s3) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by Amazon S3

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Condition key	Possible value(s)	Access level
AbortMultipartUpload	s3	s3:AbortMultipartUpload			Write
AbortMultipartUpload	s3	s3-object-lambda:AbortMultipartUpload			Write
CompleteMultipartUpload	s3	s3:PutObject			Write
CompleteMultipartUpload	s3	s3-object-lambda:PutObject			Write
CopyObject	s3	s3:GetObject			Read
		s3:GetObjectVersion			Read
		s3:PutObject			Write
		s3:PutObjectAcl			Permissions management, Write
		s3:PutObjectLegalHold			Write
		s3:PutObjectRetention			Write
		s3:PutObjectTagging			Tagging, Write
		s3-object-lambda:PutObject			Write
CreateBucket	s3	s3:CreateBucket			Write
		s3:PutBucketAcl			Permissions management, Write
		s3:PutBucketObjectLockConfiguration			Write
		s3:PutBucketOwnershipControls			Permissions management, Write
		s3:PutBucketVersioning			Write
CreateBucketMetadataConfiguration	s3	s3:CreateBucketMetadataTableConfiguration			Write
		s3tables:CreateNamespace			Write
		s3tables:CreateTable			Write
		s3tables:CreateTableBucket			Write
		s3tables:GetTable			Read
		s3tables:PutTableEncryption			Write
		s3tables:PutTablePolicy			Permissions management, Write
CreateBucketMetadataTableConfiguration	s3	s3:CreateBucketMetadataTableConfiguration			Write
		s3tables:CreateNamespace			Write
		s3tables:CreateTable			Write
		s3tables:GetTable			Read
		s3tables:PutTablePolicy			Permissions management, Write
CreateMultipartUpload	s3	s3:PutObject			Write
		s3:PutObjectAcl			Permissions management, Write
		s3:PutObjectLegalHold			Write
		s3:PutObjectRetention			Write
		s3:PutObjectTagging			Tagging, Write
		s3-object-lambda:PutObject			Write
DeleteBucket	s3	s3:DeleteBucket			Write
DeleteBucketAnalyticsConfiguration	s3	s3:PutAnalyticsConfiguration			Write
DeleteBucketCors	s3	s3:PutBucketCORS			Write
DeleteBucketEncryption	s3	s3:PutEncryptionConfiguration			Write
DeleteBucketIntelligentTieringConfiguration	s3	s3:PutIntelligentTieringConfiguration			Write
DeleteBucketInventoryConfiguration	s3	s3:PutInventoryConfiguration			Write
DeleteBucketLifecycle	s3	s3:PutLifecycleConfiguration			Write
DeleteBucketMetadataConfiguration	s3	s3:DeleteBucketMetadataTableConfiguration			Write
DeleteBucketMetadataTableConfiguration	s3	s3:DeleteBucketMetadataTableConfiguration			Write
DeleteBucketMetricsConfiguration	s3	s3:PutMetricsConfiguration			Write
DeleteBucketOwnershipControls	s3	s3:PutBucketOwnershipControls			Permissions management, Write
DeleteBucketPolicy	s3	s3:DeleteBucketPolicy			Permissions management, Write
DeleteBucketReplication	s3	s3:PutReplicationConfiguration			Write
DeleteBucketTagging	s3	s3:PutBucketTagging			Tagging, Write
DeleteBucketWebsite	s3	s3:DeleteBucketWebsite			Write
DeleteObject	s3	s3:BypassGovernanceRetention			Permissions management, Write
		s3:DeleteObject			Write
		s3:DeleteObjectVersion			Write
		s3-object-lambda:DeleteObject			Write
DeleteObjectTagging	s3	s3:DeleteObjectTagging			Tagging, Write
		s3:DeleteObjectVersionTagging			Tagging, Write
		s3-object-lambda:DeleteObjectTagging			Tagging, Write
DeleteObjects	s3	s3:BypassGovernanceRetention			Permissions management, Write
		s3:DeleteObject			Write
		s3:DeleteObjectVersion			Write
DeletePublicAccessBlock	s3	s3:PutBucketPublicAccessBlock			Permissions management, Write
GetBucketAccelerateConfiguration	s3	s3:GetAccelerateConfiguration			Read
GetBucketAcl	s3	s3:GetBucketAcl			Read
GetBucketAnalyticsConfiguration	s3	s3:GetAnalyticsConfiguration			Read
GetBucketCors	s3	s3:GetBucketCORS			Read
GetBucketEncryption	s3	s3:GetEncryptionConfiguration			Read
GetBucketIntelligentTieringConfiguration	s3	s3:GetIntelligentTieringConfiguration			Read
GetBucketInventoryConfiguration	s3	s3:GetInventoryConfiguration			Read
GetBucketLifecycle	s3	s3:GetLifecycleConfiguration			Read
GetBucketLifecycleConfiguration	s3	s3:GetLifecycleConfiguration			Read
GetBucketLifecycleConfiguration	s3	s3express:GetLifecycleConfiguration			Read
GetBucketLocation	s3	s3:GetBucketLocation			Read
GetBucketLogging	s3	s3:GetBucketLogging			Read
GetBucketMetadataConfiguration	s3	s3:GetBucketMetadataTableConfiguration			Read
GetBucketMetadataTableConfiguration	s3	s3:GetBucketMetadataTableConfiguration			Read
GetBucketMetricsConfiguration	s3	s3:GetMetricsConfiguration			Read
GetBucketNotification	s3	s3:GetBucketNotification			Read
GetBucketNotificationConfiguration	s3	s3:GetBucketNotification			Read
GetBucketOwnershipControls	s3	s3:GetBucketOwnershipControls			Read
GetBucketPolicy	s3	s3:GetBucketPolicy			Read
GetBucketPolicyStatus	s3	s3:GetBucketPolicyStatus			Read
GetBucketReplication	s3	s3:GetReplicationConfiguration			Read
GetBucketRequestPayment	s3	s3:GetBucketRequestPayment			Read
GetBucketTagging	s3	s3:GetBucketTagging			Read
GetBucketVersioning	s3	s3:GetBucketVersioning			Read
GetBucketWebsite	s3	s3:GetBucketWebsite			Read
GetObject	s3	s3:GetObject			Read
		s3:GetObjectLegalHold			Read
		s3:GetObjectRetention			Read
		s3:GetObjectTagging			Read
		s3:GetObjectVersion			Read
		s3-object-lambda:GetObject			Read
GetObjectAcl	s3	s3:GetObjectAcl			Read
		s3:GetObjectVersionAcl			Read
		s3-object-lambda:GetObjectAcl			Read
GetObjectAttributes	s3	s3:GetObject			Read
GetObjectAttributes	s3	s3:GetObjectVersion			Read
GetObjectLegalHold	s3	s3:GetObjectLegalHold			Read
GetObjectLegalHold	s3	s3-object-lambda:GetObjectLegalHold			Read
GetObjectLockConfiguration	s3	s3:GetBucketObjectLockConfiguration			Read
GetObjectRetention	s3	s3:GetObjectRetention			Read
GetObjectRetention	s3	s3-object-lambda:GetObjectRetention			Read
GetObjectTagging	s3	s3:GetObjectTagging			Read
		s3:GetObjectVersionTagging			Read
		s3-object-lambda:GetObjectTagging			Read
GetObjectTorrent	s3	s3:GetObject			Read
GetPublicAccessBlock	s3	s3:GetBucketPublicAccessBlock			Read
HeadBucket	s3	s3:ListBucket			List
HeadObject	s3	s3:GetObject			Read
		s3:GetObjectLegalHold			Read
		s3:GetObjectRetention			Read
		s3-object-lambda:GetObject			Read
ListBucketAnalyticsConfigurations	s3	s3:GetAnalyticsConfiguration			Read
ListBucketIntelligentTieringConfigurations	s3	s3:GetIntelligentTieringConfiguration			Read
ListBucketInventoryConfigurations	s3	s3:GetInventoryConfiguration			Read
ListBucketMetricsConfigurations	s3	s3:GetMetricsConfiguration			Read
ListBuckets	s3	s3:ListAllMyBuckets			List
ListMultipartUploads	s3	s3:ListBucketMultipartUploads			List
ListMultipartUploads	s3	s3-object-lambda:ListBucketMultipartUploads			List
ListObjectVersions	s3	s3:ListBucketVersions			List
ListObjects	s3	s3:GetObjectAcl			Read
		s3:ListBucket			List
		s3-object-lambda:ListBucket			List
ListObjectsV2	s3	s3:GetObjectAcl			Read
		s3:ListBucket			List
		s3-object-lambda:ListBucket			List
ListParts	s3	s3:ListMultipartUploadParts			List
ListParts	s3	s3-object-lambda:ListMultipartUploadParts			List
PutBucketAccelerateConfiguration	s3	s3:PutAccelerateConfiguration			Write
PutBucketAcl	s3	s3:PutBucketAcl			Permissions management, Write
PutBucketAnalyticsConfiguration	s3	s3:PutAnalyticsConfiguration			Write
PutBucketCors	s3	s3:PutBucketCORS			Write
PutBucketEncryption	s3	s3:PutEncryptionConfiguration			Write
PutBucketIntelligentTieringConfiguration	s3	s3:PutIntelligentTieringConfiguration			Write
PutBucketInventoryConfiguration	s3	s3:PutInventoryConfiguration			Write
PutBucketLifecycle	s3	s3:PutLifecycleConfiguration			Write
PutBucketLifecycleConfiguration	s3	s3:PutLifecycleConfiguration			Write
PutBucketLifecycleConfiguration	s3	s3express:PutLifecycleConfiguration			Write
PutBucketLogging	s3	s3:PutBucketLogging			Write
PutBucketMetricsConfiguration	s3	s3:PutMetricsConfiguration			Write
PutBucketNotificationConfiguration	s3	s3:PutBucketNotification			Write
PutBucketOwnershipControls	s3	s3:PutBucketOwnershipControls			Permissions management, Write
PutBucketPolicy	s3	s3:PutBucketPolicy			Permissions management, Write
PutBucketReplication	s3	s3:PutReplicationConfiguration			Write
PutBucketReplication	s3	iam:PassRole	iam:PassedToService	s3.amazonaws.com	Write
PutBucketRequestPayment	s3	s3:PutBucketRequestPayment			Write
PutBucketTagging	s3	s3:PutBucketTagging			Tagging, Write
PutBucketVersioning	s3	s3:PutBucketVersioning			Write
PutBucketWebsite	s3	s3:PutBucketWebsite			Write
PutObject	s3	s3:PutObject			Write
		s3:PutObjectAcl			Permissions management, Write
		s3:PutObjectLegalHold			Write
		s3:PutObjectRetention			Write
		s3:PutObjectTagging			Tagging, Write
		s3-object-lambda:PutObject			Write
PutObjectAcl	s3	s3:PutObjectAcl			Permissions management, Write
		s3:PutObjectVersionAcl			Permissions management, Write
		s3-object-lambda:PutObjectAcl			Permissions management, Write
PutObjectLegalHold	s3	s3:PutObjectLegalHold			Write
PutObjectLegalHold	s3	s3-object-lambda:PutObjectLegalHold			Write
PutObjectLockConfiguration	s3	s3:PutBucketObjectLockConfiguration			Write
PutObjectRetention	s3	s3:BypassGovernanceRetention			Permissions management, Write
		s3:PutObjectRetention			Write
		s3-object-lambda:PutObjectRetention			Write
PutObjectTagging	s3	s3:PutObjectTagging			Tagging, Write
		s3:PutObjectVersionTagging			Tagging, Write
		s3-object-lambda:PutObjectTagging			Tagging, Write
PutPublicAccessBlock	s3	s3:PutBucketPublicAccessBlock			Permissions management, Write
RestoreObject	s3	s3:RestoreObject			Write
RestoreObject	s3	s3-object-lambda:RestoreObject			Write
SelectObjectContent	s3	s3:GetObject			Read
UpdateBucketMetadataInventoryTableConfiguration	s3	s3:UpdateBucketMetadataInventoryTableConfiguration			Write
		s3tables:CreateNamespace			Write
		s3tables:CreateTable			Write
		s3tables:CreateTableBucket			Write
		s3tables:GetTable			Read
		s3tables:PutTableEncryption			Write
		s3tables:PutTablePolicy			Permissions management, Write
UpdateBucketMetadataJournalTableConfiguration	s3	s3:UpdateBucketMetadataJournalTableConfiguration			Write
UploadPart	s3	s3:PutObject			Write
UploadPart	s3	s3-object-lambda:PutObject			Write
UploadPartCopy	s3	s3:GetObject			Read
		s3:GetObjectVersion			Read
		s3:PutObject			Write
AssociateAccessGrantsIdentityCenter	s3control	s3:AssociateAccessGrantsIdentityCenter			Permissions management, Write
		sso:CreateApplication			Write
		sso:PutApplicationAuthenticationMethod			Write
		sso:PutApplicationGrant			Write
CreateAccessGrant	s3control	s3:CreateAccessGrant			Permissions management, Write
		identitystore:DescribeUser			Read
		sso:DescribeApplication			Read
		sso:DescribeInstance			Read
CreateAccessGrantsInstance	s3control	s3:CreateAccessGrantsInstance			Permissions management, Write
		sso:CreateApplication			Write
		sso:DescribeInstance			Read
		sso:PutApplicationAuthenticationMethod			Write
		sso:PutApplicationGrant			Write
CreateAccessGrantsLocation	s3control	s3:CreateAccessGrantsLocation			Permissions management, Write
CreateAccessGrantsLocation	s3control	iam:PassRole			Write
CreateAccessPoint	s3control	s3:CreateAccessPoint			Write
CreateAccessPointForObjectLambda	s3control	s3:CreateAccessPointForObjectLambda			Write
CreateBucket	s3control	s3:CreateBucket			Write
		s3:PutBucketAcl			Permissions management, Write
		s3:PutBucketObjectLockConfiguration			Write
		s3:PutBucketOwnershipControls			Permissions management, Write
		s3:PutBucketVersioning			Write
CreateJob	s3control	s3:CreateJob			Write
CreateMultiRegionAccessPoint	s3control	s3:CreateMultiRegionAccessPoint			Write
CreateStorageLensGroup	s3control	s3:CreateStorageLensGroup			Write
CreateStorageLensGroup	s3control	s3:TagResource			Tagging, Write
DeleteAccessGrant	s3control	s3:DeleteAccessGrant			Permissions management, Write
DeleteAccessGrantsInstance	s3control	s3:DeleteAccessGrantsInstance			Permissions management, Write
DeleteAccessGrantsInstanceResourcePolicy	s3control	s3:DeleteAccessGrantsInstanceResourcePolicy			Permissions management, Write
DeleteAccessGrantsLocation	s3control	s3:DeleteAccessGrantsLocation			Permissions management, Write
DeleteAccessPoint	s3control	s3:DeleteAccessPoint			Write
DeleteAccessPointForObjectLambda	s3control	s3:DeleteAccessPointForObjectLambda			Write
DeleteAccessPointPolicy	s3control	s3:DeleteAccessPointPolicy			Permissions management, Write
DeleteAccessPointPolicyForObjectLambda	s3control	s3:DeleteAccessPointPolicyForObjectLambda			Permissions management, Write
DeleteBucket	s3control	s3:DeleteBucket			Write
DeleteBucketPolicy	s3control	s3:DeleteBucketPolicy			Permissions management, Write
DeleteBucketReplication	s3control	s3:PutReplicationConfiguration			Write
DeleteBucketTagging	s3control	s3:PutBucketTagging			Tagging, Write
DeleteJobTagging	s3control	s3:DeleteJobTagging			Tagging, Write
DeleteMultiRegionAccessPoint	s3control	s3:DeleteMultiRegionAccessPoint			Write
DeletePublicAccessBlock	s3control	s3:PutBucketPublicAccessBlock			Permissions management, Write
DeleteStorageLensConfiguration	s3control	s3:DeleteStorageLensConfiguration			Write
DeleteStorageLensConfigurationTagging	s3control	s3:DeleteStorageLensConfigurationTagging			Tagging, Write
DeleteStorageLensGroup	s3control	s3:DeleteStorageLensGroup			Write
DescribeJob	s3control	s3:DescribeJob			Read
DescribeMultiRegionAccessPointOperation	s3control	s3:DescribeMultiRegionAccessPointOperation			Read
DissociateAccessGrantsIdentityCenter	s3control	s3:DissociateAccessGrantsIdentityCenter			Permissions management, Write
DissociateAccessGrantsIdentityCenter	s3control	sso:DeleteApplication			Write
GetAccessGrant	s3control	s3:GetAccessGrant			Read
GetAccessGrantsInstance	s3control	s3:GetAccessGrantsInstance			Read
GetAccessGrantsInstanceForPrefix	s3control	s3:GetAccessGrantsInstanceForPrefix			Read
GetAccessGrantsInstanceResourcePolicy	s3control	s3:GetAccessGrantsInstanceResourcePolicy			Read
GetAccessGrantsLocation	s3control	s3:GetAccessGrantsLocation			Read
GetAccessPoint	s3control	s3:GetAccessPoint			Read
GetAccessPointConfigurationForObjectLambda	s3control	s3:GetAccessPointConfigurationForObjectLambda			Read
GetAccessPointForObjectLambda	s3control	s3:GetAccessPointForObjectLambda			Read
GetAccessPointPolicy	s3control	s3:GetAccessPointPolicy			Read
GetAccessPointPolicyForObjectLambda	s3control	s3:GetAccessPointPolicyForObjectLambda			Read
GetAccessPointPolicyStatus	s3control	s3:GetAccessPointPolicyStatus			Read
GetAccessPointPolicyStatusForObjectLambda	s3control	s3:GetAccessPointPolicyStatusForObjectLambda			Read
GetBucketLifecycleConfiguration	s3control	s3:GetLifecycleConfiguration			Read
GetBucketLifecycleConfiguration	s3control	s3express:GetLifecycleConfiguration			Read
GetBucketPolicy	s3control	s3:GetBucketPolicy			Read
GetBucketReplication	s3control	s3:GetReplicationConfiguration			Read
GetBucketTagging	s3control	s3:GetBucketTagging			Read
GetBucketVersioning	s3control	s3:GetBucketVersioning			Read
GetDataAccess	s3control	s3:GetDataAccess			Read
GetJobTagging	s3control	s3:GetJobTagging			Read
GetMultiRegionAccessPoint	s3control	s3:GetMultiRegionAccessPoint			Read
GetMultiRegionAccessPointPolicy	s3control	s3:GetMultiRegionAccessPointPolicy			Read
GetMultiRegionAccessPointPolicyStatus	s3control	s3:GetMultiRegionAccessPointPolicyStatus			Read
GetMultiRegionAccessPointRoutes	s3control	s3:GetMultiRegionAccessPointRoutes			Read
GetPublicAccessBlock	s3control	s3:GetBucketPublicAccessBlock			Read
GetStorageLensConfiguration	s3control	s3:GetStorageLensConfiguration			Read
GetStorageLensConfigurationTagging	s3control	s3:GetStorageLensConfigurationTagging			Read
GetStorageLensGroup	s3control	s3:GetStorageLensGroup			Read
ListAccessGrants	s3control	s3:ListAccessGrants			List
ListAccessGrantsInstances	s3control	s3:ListAccessGrantsInstances			List
ListAccessGrantsLocations	s3control	s3:ListAccessGrantsLocations			List
ListAccessPoints	s3control	s3:ListAccessPoints			List
ListAccessPointsForObjectLambda	s3control	s3:ListAccessPointsForObjectLambda			List
ListCallerAccessGrants	s3control	s3:ListCallerAccessGrants			List
ListJobs	s3control	s3:ListJobs			List
ListMultiRegionAccessPoints	s3control	s3:ListMultiRegionAccessPoints			List
ListStorageLensConfigurations	s3control	s3:ListStorageLensConfigurations			List
ListStorageLensGroups	s3control	s3:ListStorageLensGroups			List
ListTagsForResource	s3control	s3:ListTagsForResource			List
PutAccessGrantsInstanceResourcePolicy	s3control	s3:PutAccessGrantsInstanceResourcePolicy			Permissions management, Write
PutAccessPointConfigurationForObjectLambda	s3control	s3:PutAccessPointConfigurationForObjectLambda			Write
PutAccessPointPolicy	s3control	s3:PutAccessPointPolicy			Permissions management, Write
PutAccessPointPolicyForObjectLambda	s3control	s3:PutAccessPointPolicyForObjectLambda			Permissions management, Write
PutBucketLifecycleConfiguration	s3control	s3:PutLifecycleConfiguration			Write
PutBucketLifecycleConfiguration	s3control	s3express:PutLifecycleConfiguration			Write
PutBucketPolicy	s3control	s3:PutBucketPolicy			Permissions management, Write
PutBucketReplication	s3control	s3:PutReplicationConfiguration			Write
PutBucketReplication	s3control	iam:PassRole	iam:PassedToService	s3.amazonaws.com	Write
PutBucketTagging	s3control	s3:PutBucketTagging			Tagging, Write
PutBucketVersioning	s3control	s3:PutBucketVersioning			Write
PutJobTagging	s3control	s3:PutJobTagging			Tagging, Write
PutMultiRegionAccessPointPolicy	s3control	s3:PutMultiRegionAccessPointPolicy			Permissions management, Write
PutPublicAccessBlock	s3control	s3:PutBucketPublicAccessBlock			Permissions management, Write
PutStorageLensConfiguration	s3control	s3:PutStorageLensConfiguration			Write
PutStorageLensConfigurationTagging	s3control	s3:PutStorageLensConfigurationTagging			Tagging, Write
SubmitMultiRegionAccessPointRoutes	s3control	s3:SubmitMultiRegionAccessPointRoutes			Write
TagResource	s3control	s3:TagResource			Tagging, Write
UntagResource	s3control	s3:UntagResource			Tagging, Write
UpdateAccessGrantsLocation	s3control	s3:UpdateAccessGrantsLocation			Permissions management, Write
UpdateJobPriority	s3control	s3:UpdateJobPriority			Write
UpdateJobStatus	s3control	s3:UpdateJobStatus			Write
UpdateStorageLensGroup	s3control	s3:UpdateStorageLensGroup			Write

Actions defined by Amazon S3

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AbortMultipartUpload	Grants permission to abort a multipart upload	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
AbortMultipartUpload	Grants permission to abort a multipart upload	object	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
AllowVendedLogDeliveryForResource	Grants permission to configure server access logs delivery to CloudWatch	bucket*	aws:ResourceTag/${TagKey} s3:BucketTag/${TagKey} s3:deliverySourceArn s3:logType s3:resourceArnBeingAuthorized	Read
AssociateAccessGrantsIdentityCenter	Grants permission to associate Access Grants identity center	accessgrantsinstance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
BypassGovernanceRetention	Grants permission to allow circumvention of governance-mode object retention settings	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-copy-source s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-metadata-directive s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id s3:x-amz-server-side-encryption-customer-algorithm s3:x-amz-storage-class s3:x-amz-website-redirect-location	Permissions management, Write
BypassGovernanceRetention		object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-copy-source s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-metadata-directive s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id s3:x-amz-server-side-encryption-customer-algorithm s3:x-amz-storage-class s3:x-amz-website-redirect-location	Permissions management, Write
CreateAccessGrant	Grants permission to create Access Grant	accessgrantslocation*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:AccessGrantScope s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
CreateAccessGrantsInstance	Grants permission to Create Access Grants Instance	accessgrantsinstance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
CreateAccessGrantsLocation	Grants permission to create Access Grants location	accessgrantsinstance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:AccessGrantsLocationScope s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
CreateAccessPoint	Grants permission to create a new access point	accesspoint*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:locationconstraint s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256	Write
CreateAccessPointForObjectLambda	Grants permission to create an object lambda enabled accesspoint	objectlambdaaccesspoint*	s3:AccessPointNetworkOrigin s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
CreateBucket	Grants permission to create a new bucket	bucket*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:BucketTag/${TagKey} s3:locationconstraint s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-bucket-namespace s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-object-ownership	Write
CreateBucketMetadataTableConfiguration	Grants permission to create a new S3 Metadata configuration for a specified general purpose bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
CreateJob	Grants permission to create a new Amazon S3 Batch Operations job		aws:RequestTag/${TagKey} aws:TagKeys s3:authType s3:RequestJobOperation s3:RequestJobPriority s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
CreateMultiRegionAccessPoint	Grants permission to create a new Multi-Region Access Point	multiregionaccesspoint*	s3:AccessPointNetworkOrigin s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion	Write
CreateStorageLensGroup	Grants permission to create an Amazon S3 Storage Lens group		aws:RequestTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
DeleteAccessGrant	Grants permission to delete Access Grant	accessgrant*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:AccessGrantScope s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
DeleteAccessGrantsInstance	Grants permission to Delete Access Grants Instance	accessgrantsinstance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
DeleteAccessGrantsInstanceResourcePolicy	Grants permission to read Access grants instance resource policy	accessgrantsinstance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
DeleteAccessGrantsLocation	Grants permission to delete Access Grants location	accessgrantslocation*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:AccessGrantsLocationScope s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
DeleteAccessPoint	Grants permission to delete the access point named in the URI	accesspoint*	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
DeleteAccessPointForObjectLambda	Grants permission to delete the object lambda enabled access point named in the URI	objectlambdaaccesspoint*	s3:AccessPointNetworkOrigin s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
DeleteAccessPointPolicy	Grants permission to delete the policy on a specified access point	accesspoint*	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
DeleteAccessPointPolicyForObjectLambda	Grants permission to delete the policy on a specified object lambda enabled access point	objectlambdaaccesspoint*	s3:AccessPointNetworkOrigin s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
DeleteBucket	Grants permission to delete the bucket named in the URI	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
DeleteBucketMetadataTableConfiguration	Grants permission to delete the S3 Metadata configuration for a specified general purpose bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
DeleteBucketPolicy	Grants permission to delete the policy on a specified bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
DeleteBucketWebsite	Grants permission to remove the website configuration for a bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
DeleteJobTagging	Grants permission to remove tags from an existing Amazon S3 Batch Operations job	job*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ExistingJobOperation s3:ExistingJobPriority s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Tagging, Write
DeleteMultiRegionAccessPoint	Grants permission to delete the Multi-Region Access Point named in the URI	multiregionaccesspoint*	s3:AccessPointNetworkOrigin s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion	Write
DeleteObject	Grants permission to remove the null version of an object and insert a delete marker, which becomes the current version of the object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:if-match s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
DeleteObject		object	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:authType s3:BucketTag/${TagKey} s3:if-match s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
DeleteObjectAnnotation	Grants permission to delete an annotation from an object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:x-amz-object-if-match	Write
DeleteObjectAnnotation	Grants permission to delete an annotation from an object	object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:x-amz-object-if-match	Write
DeleteObjectTagging	Grants permission to use the tagging subresource to remove the entire tag set from the specified object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Tagging, Write
DeleteObjectTagging		object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Tagging, Write
DeleteObjectVersion	Grants permission to remove a specific version of an object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	Write
DeleteObjectVersion	Grants permission to remove a specific version of an object	object	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	Write
DeleteObjectVersionAnnotation	Grants permission to delete an annotation from a specific version of an object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256 s3:x-amz-object-if-match	Write
DeleteObjectVersionAnnotation		object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256 s3:x-amz-object-if-match	Write
DeleteObjectVersionTagging	Grants permission to remove the entire tag set for a specific version of the object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	Tagging, Write
DeleteObjectVersionTagging		object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	Tagging, Write
DeleteStorageLensConfiguration	Grants permission to delete an existing Amazon S3 Storage Lens configuration	storagelensconfiguration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
DeleteStorageLensConfigurationTagging	Grants permission to remove tags from an existing Amazon S3 Storage Lens configuration	storagelensconfiguration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Tagging, Write
DeleteStorageLensGroup	Grants permission to delete an existing S3 Storage Lens group	storagelensgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
DescribeJob	Grants permission to retrieve the configuration parameters and status for a batch operations job	job*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
DescribeMultiRegionAccessPointOperation	Grants permission to retrieve the configurations for a Multi-Region Access Point	multiregionaccesspointrequestarn*	s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion	Read
DissociateAccessGrantsIdentityCenter	Grants permission to disassociate Access Grants identity center	accessgrantsinstance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
GetAccelerateConfiguration	Grants permission to uses the accelerate subresource to return the Transfer Acceleration state of a bucket, which is either Enabled or Suspended	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetAccessGrant	Grants permission to read Access Grant	accessgrant*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:AccessGrantScope s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetAccessGrantsInstance	Grants permission to Read Access Grants Instance	accessgrantsinstance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetAccessGrantsInstanceForPrefix	Grants permission to Read Access Grants Instance by prefix	accessgrantsinstance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetAccessGrantsInstanceResourcePolicy	Grants permission to read Access grants instance resource policy	accessgrantsinstance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetAccessGrantsLocation	Grants permission to read Access Grants location	accessgrantslocation*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:AccessGrantsLocationScope s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetAccessPoint	Grants permission to return configuration information about the specified access point		aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetAccessPointConfigurationForObjectLambda	Grants permission to retrieve the configuration of the object lambda enabled access point	objectlambdaaccesspoint*	s3:AccessPointNetworkOrigin s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetAccessPointForObjectLambda	Grants permission to create an object lambda enabled accesspoint	objectlambdaaccesspoint*	s3:AccessPointNetworkOrigin s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetAccessPointPolicy	Grants permission to return the access point policy associated with the specified access point	accesspoint*	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetAccessPointPolicyForObjectLambda	Grants permission to return the access point policy associated with the specified object lambda enabled access point	objectlambdaaccesspoint*	s3:AccessPointNetworkOrigin s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetAccessPointPolicyStatus	Grants permission to return the policy status for a specific access point policy	accesspoint*	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetAccessPointPolicyStatusForObjectLambda	Grants permission to return the policy status for a specific object lambda access point policy	objectlambdaaccesspoint*	s3:AccessPointNetworkOrigin s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetAccountPublicAccessBlock	Grants permission to retrieve the PublicAccessBlock configuration for an Amazon Web Services account		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetAnalyticsConfiguration	Grants permission to get an analytics configuration from an Amazon S3 bucket, identified by the analytics configuration ID	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketAbac	Grants permission to retrieve ABAC configuration for a general purpose bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketAcl	Grants permission to use the acl subresource to return the access control list (ACL) of an Amazon S3 bucket	accesspoint	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketAcl		bucket	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketCORS	Grants permission to return the CORS configuration information set for an Amazon S3 bucket	accesspoint	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketCORS		bucket	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketLocation	Grants permission to return the Region that an Amazon S3 bucket resides in	accesspoint	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketLocation		bucket	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketLogging	Grants permission to return the logging status of an Amazon S3 bucket and the permissions users have to view or modify that status	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketMetadataTableConfiguration	Grants permission to return the S3 Metadata configuration for a specified general purpose bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketNotification	Grants permission to get the notification configuration of an Amazon S3 bucket	accesspoint	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketNotification		bucket	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketObjectLockConfiguration	Grants permission to get the Object Lock configuration of an Amazon S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion	Read
GetBucketOwnershipControls	Grants permission to retrieve ownership controls on a bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketPolicy	Grants permission to return the policy of the specified bucket	accesspoint	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketPolicy		bucket	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketPolicyStatus	Grants permission to retrieve the policy status for a specific Amazon S3 bucket, which indicates whether the bucket is public	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketPublicAccessBlock	Grants permission to retrieve the PublicAccessBlock configuration for an Amazon S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketRequestPayment	Grants permission to return the request payment configuration for an Amazon S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketTagging	Grants permission to return the tag set associated with an Amazon S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketVersioning	Grants permission to return the versioning state of an Amazon S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetBucketWebsite	Grants permission to return the website configuration for an Amazon S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetDataAccess	Grants permission to get Access	accessgrantsinstance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetEncryptionConfiguration	Grants permission to return the default encryption configuration an Amazon S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetIntelligentTieringConfiguration	Grants permission to get an or list all Amazon S3 Intelligent Tiering configuration in a S3 Bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetInventoryConfiguration	Grants permission to return an inventory configuration from an Amazon S3 bucket, identified by the inventory configuration ID	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetJobTagging	Grants permission to return the tag set of an existing Amazon S3 Batch Operations job	job*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetLifecycleConfiguration	Grants permission to return the lifecycle configuration information set on an Amazon S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetMetricsConfiguration	Grants permission to get a metrics configuration from an Amazon S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetMultiRegionAccessPoint	Grants permission to return configuration information about the specified Multi-Region Access Point	multiregionaccesspoint*	s3:AccessPointNetworkOrigin s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion	Read
GetMultiRegionAccessPointPolicy	Grants permission to return the access point policy associated with the specified Multi-Region Access Point	multiregionaccesspoint*	s3:AccessPointNetworkOrigin s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion	Read
GetMultiRegionAccessPointPolicyStatus	Grants permission to return the policy status for a specific Multi-Region Access Point policy	multiregionaccesspoint*	s3:AccessPointNetworkOrigin s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion	Read
GetMultiRegionAccessPointRoutes	Grants permission to return the route configuration for a Multi-Region Access Point	multiregionaccesspoint*	s3:AccessPointNetworkOrigin s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion	Read
GetObject	Grants permission to retrieve objects from Amazon S3	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetObject	Grants permission to retrieve objects from Amazon S3	object	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetObjectAcl	Grants permission to return the access control list (ACL) of an object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetObjectAcl		object	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetObjectAnnotation	Grants permission to retrieve an annotation from an object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetObjectAnnotation	Grants permission to retrieve an annotation from an object	object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetObjectAttributes	Grants permission to retrieve attributes related to a specific object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetObjectAttributes		object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetObjectLegalHold	Grants permission to get an object's current Legal Hold status	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetObjectLegalHold		object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetObjectRetention	Grants permission to retrieve the retention settings for an object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetObjectRetention		object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetObjectTagging	Grants permission to return the tag set of an object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetObjectTagging	Grants permission to return the tag set of an object	object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetObjectTorrent	Grants permission to return torrent files from an Amazon S3 bucket	object*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetObjectVersion	Grants permission to retrieve a specific version of an object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	Read
GetObjectVersion		object	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	Read
GetObjectVersionAcl	Grants permission to return the access control list (ACL) of a specific object version	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	Read
GetObjectVersionAcl		object	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	Read
GetObjectVersionAnnotation	Grants permission to retrieve an annotation from a specific version of an object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	Read
GetObjectVersionAnnotation		object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	Read
GetObjectVersionAnnotationForReplication	Grants permission to get an object version annotation for replication	object*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetObjectVersionAttributes	Grants permission to retrieve attributes related to a specific version of an object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	Read
GetObjectVersionAttributes		object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	Read
GetObjectVersionForReplication	Grants permission to replicate both unencrypted objects and objects encrypted with SSE-S3 or SSE-KMS	object*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetObjectVersionTagging	Grants permission to return the tag set for a specific version of the object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	Read
GetObjectVersionTagging		object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	Read
GetObjectVersionTorrent	Grants permission to get Torrent files about a different version using the versionId subresource	object*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	Read
GetReplicationConfiguration	Grants permission to get the replication configuration information set on an Amazon S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetStorageLensConfiguration	Grants permission to get an Amazon S3 Storage Lens configuration	storagelensconfiguration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetStorageLensConfigurationTagging	Grants permission to get the tag set of an existing Amazon S3 Storage Lens configuration	storagelensconfiguration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetStorageLensDashboard	Grants permission to get an Amazon S3 Storage Lens dashboard	storagelensconfiguration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
GetStorageLensGroup	Grants permission to get an Amazon S3 Storage Lens group	storagelensgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Read
ListAccessGrants	Grants permission to list Access Grant	accessgrantsinstance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListAccessGrantsInstances	Grants permission to List Access Grants Instances		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListAccessGrantsLocations	Grants permission to list Access Grants locations	accessgrantsinstance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListAccessPoints	Grants permission to list access points		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListAccessPointsForObjectLambda	Grants permission to list object lambda enabled accesspoints		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListAllMyBuckets	Grants permission to list all buckets owned by the authenticated sender of the request		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListBucket	Grants permission to list some or all of the objects in an Amazon S3 bucket (up to 1000)	accesspoint	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:delimiter s3:max-keys s3:prefix s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListBucket		bucket	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:authType s3:BucketTag/${TagKey} s3:delimiter s3:max-keys s3:prefix s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListBucketMultipartUploads	Grants permission to list in-progress multipart uploads	bucket*	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListBucketVersions	Grants permission to list metadata about all the versions of objects in an Amazon S3 bucket	accesspoint	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:delimiter s3:max-keys s3:prefix s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListBucketVersions		bucket	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:authType s3:BucketTag/${TagKey} s3:delimiter s3:max-keys s3:prefix s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListCallerAccessGrants	Grants permission to list caller's Access Grant	accessgrantsinstance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListJobs	Grants permission to list current jobs and jobs that have ended recently		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListMultiRegionAccessPoints	Grants permission to list Multi-Region Access Points		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion	List
ListMultipartUploadParts	Grants permission to list the parts that have been uploaded for a specific multipart upload	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListMultipartUploadParts		object	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListObjectAnnotations	Grants permission to list annotations on an object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:annotation-prefix s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:max-annotation-results s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListObjectAnnotations	Grants permission to list annotations on an object	object	aws:ResourceTag/${TagKey} s3:annotation-prefix s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:max-annotation-results s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListObjectVersionAnnotations	Grants permission to list annotations on a specific version of an object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:annotation-prefix s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:max-annotation-results s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	List
ListObjectVersionAnnotations		object	aws:ResourceTag/${TagKey} s3:annotation-prefix s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:max-annotation-results s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	List
ListStorageLensConfigurations	Grants permission to list Amazon S3 Storage Lens configurations		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListStorageLensGroups	Grants permission to list S3 Storage Lens groups		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
ListTagsForResource	Grants permission to list the tags attached to the specified resource	accessgrant	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	List
		accessgrantsinstance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
		accessgrantslocation	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
		accesspoint	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
		bucket	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
		storagelensgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ObjectOwnerOverrideToBucketOwner	Grants permission to change replica ownership	object*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
PutAccelerateConfiguration	Grants permission to use the accelerate subresource to set the Transfer Acceleration state of an existing S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutAccessGrantsInstanceResourcePolicy	Grants permission to put Access grants instance resource policy	accessgrantsinstance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
PutAccessPointConfigurationForObjectLambda	Grants permission to set the configuration of the object lambda enabled access point	objectlambdaaccesspoint*	s3:AccessPointNetworkOrigin s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutAccessPointPolicy	Grants permission to associate an access policy with a specified access point	accesspoint*	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
PutAccessPointPolicyForObjectLambda	Grants permission to associate an access policy with a specified object lambda enabled access point	objectlambdaaccesspoint*	s3:AccessPointNetworkOrigin s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
PutAccessPointPublicAccessBlock	Grants permission to associate public access block configurations with a specified access point, while creating a access point			Permissions management, Write
PutAccountPublicAccessBlock	Grants permission to create or modify the PublicAccessBlock configuration for an Amazon Web Services account		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
PutAnalyticsConfiguration	Grants permission to set an analytics configuration for the bucket, specified by the analytics configuration ID	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutBucketAbac	Grants permission to set ABAC configuration for a general purpose bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutBucketAcl	Grants permission to set the permissions on an existing bucket using access control lists (ACLs)	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp	Permissions management, Write
PutBucketCORS	Grants permission to set the CORS configuration for an Amazon S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutBucketLogging	Grants permission to set the logging parameters for an Amazon S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutBucketNotification	Grants permission to receive notifications when certain events happen in an Amazon S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutBucketObjectLockConfiguration	Grants permission to put Object Lock configuration on a specific bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion	Write
PutBucketOwnershipControls	Grants permission to add, replace or delete ownership controls on a bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
PutBucketPolicy	Grants permission to add or replace a bucket policy on a bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
PutBucketPublicAccessBlock	Grants permission to create or modify the PublicAccessBlock configuration for a specific Amazon S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
PutBucketRequestPayment	Grants permission to set the request payment configuration of a bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutBucketTagging	Grants permission to add a set of tags to an existing Amazon S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Tagging, Write
PutBucketVersioning	Grants permission to set the versioning state of an existing Amazon S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutBucketWebsite	Grants permission to set the configuration of the website that is specified in the website subresource	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutEncryptionConfiguration	Grants permission to set the encryption configuration for an Amazon S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutIntelligentTieringConfiguration	Grants permission to create new or update or delete an existing Amazon S3 Intelligent Tiering configuration	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutInventoryConfiguration	Grants permission to add an inventory configuration to the bucket, identified by the inventory ID	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:InventoryAccessibleOptionalFields s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutJobTagging	Grants permission to replace tags on an existing Amazon S3 Batch Operations job	job*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ExistingJobOperation s3:ExistingJobPriority s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Tagging, Write
PutLifecycleConfiguration	Grants permission to create a new lifecycle configuration for the bucket or replace an existing lifecycle configuration	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutMetricsConfiguration	Grants permission to set or update a metrics configuration for the CloudWatch request metrics from an Amazon S3 bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutMultiRegionAccessPointPolicy	Grants permission to associate an access policy with a specified Multi-Region Access Point	multiregionaccesspoint*	s3:AccessPointNetworkOrigin s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion	Permissions management, Write
PutObject	Grants permission to add an object to a bucket	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:if-match s3:if-none-match s3:object-lock-legal-hold s3:object-lock-mode s3:object-lock-remaining-retention-days s3:object-lock-retain-until-date s3:ObjectCreationOperation s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-copy-source s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-metadata-directive s3:x-amz-object-annotation-directive s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id s3:x-amz-server-side-encryption-customer-algorithm s3:x-amz-storage-class s3:x-amz-website-redirect-location	Write
PutObject	Grants permission to add an object to a bucket	object	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:authType s3:BucketTag/${TagKey} s3:if-match s3:if-none-match s3:object-lock-legal-hold s3:object-lock-mode s3:object-lock-remaining-retention-days s3:object-lock-retain-until-date s3:ObjectCreationOperation s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-copy-source s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-metadata-directive s3:x-amz-object-annotation-directive s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id s3:x-amz-server-side-encryption-customer-algorithm s3:x-amz-storage-class s3:x-amz-website-redirect-location	Write
PutObjectAcl	Grants permission to set the access control list (ACL) permissions for new or existing objects in an S3 bucket	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-storage-class	Permissions management, Write
PutObjectAcl		object	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-storage-class	Permissions management, Write
PutObjectAnnotation	Grants permission to add or replace an annotation on an object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:x-amz-object-if-match	Write
PutObjectAnnotation		object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:x-amz-object-if-match	Write
PutObjectLegalHold	Grants permission to apply a Legal Hold configuration to the specified object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:object-lock-legal-hold s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutObjectLegalHold		object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:object-lock-legal-hold s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutObjectRetention	Grants permission to place an Object Retention configuration on an object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:object-lock-mode s3:object-lock-remaining-retention-days s3:object-lock-retain-until-date s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutObjectRetention		object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:object-lock-mode s3:object-lock-remaining-retention-days s3:object-lock-retain-until-date s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutObjectTagging	Grants permission to set the supplied tag-set to an object that already exists in a bucket	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Tagging, Write
PutObjectTagging		object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Tagging, Write
PutObjectVersionAcl	Grants permission to use the acl subresource to set the access control list (ACL) permissions for an object that already exists in a bucket	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-storage-class	Permissions management, Write
PutObjectVersionAcl		object	aws:ResourceTag/${TagKey} s3:AccessGrantsInstanceArn s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-storage-class	Permissions management, Write
PutObjectVersionAnnotation	Grants permission to add or replace an annotation on a specific version of an object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256 s3:x-amz-object-if-match	Write
PutObjectVersionAnnotation		object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256 s3:x-amz-object-if-match	Write
PutObjectVersionTagging	Grants permission to set the supplied tag-set for a specific version of an object	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	Tagging, Write
PutObjectVersionTagging		object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256	Tagging, Write
PutReplicationConfiguration	Grants permission to create a new replication configuration or replace an existing one	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:isReplicationPauseRequest s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutStorageLensConfiguration	Grants permission to create or update an Amazon S3 Storage Lens configuration		aws:RequestTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
PutStorageLensConfigurationTagging	Grants permission to put or replace tags on an existing Amazon S3 Storage Lens configuration	storagelensconfiguration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Tagging, Write
ReplicateDelete	Grants permission to replicate delete markers to the destination bucket	object*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
ReplicateObject	Grants permission to replicate objects and object tags to the destination bucket	object*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id s3:x-amz-server-side-encryption-customer-algorithm	Write
ReplicateObjectAnnotation	Grants permission to replicate annotations to the destination bucket	object*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
ReplicateTags	Grants permission to replicate object tags to the destination bucket	object*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Tagging, Write
RestoreObject	Grants permission to restore an archived copy of an object back into Amazon S3	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
RestoreObject		object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
SubmitMultiRegionAccessPointRoutes	Grants permission to submit a route configuration update for a Multi-Region Access Point	multiregionaccesspoint*	s3:AccessPointNetworkOrigin s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion	Write
TagResource	Grants permission to add tags to the specified resource	accessgrant	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Tagging, Write
		accessgrantsinstance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
		accessgrantslocation	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
		accesspoint	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
		bucket	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
		storagelensgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
UntagResource	Grants permission to remove tags from the specified resource	accessgrant	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Tagging, Write
		accessgrantsinstance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
		accessgrantslocation	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
		accesspoint	aws:ResourceTag/${TagKey} aws:TagKeys s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:DataAccessPointAccount s3:DataAccessPointArn s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
		bucket	aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
		storagelensgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
UpdateAccessGrantsLocation	Grants permission to update Access Grants location	accessgrantslocation*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:AccessGrantsLocationScope s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Permissions management, Write
UpdateBucketMetadataAnnotationTableConfiguration	Grants permission to update the annotation table configuration for a bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
UpdateBucketMetadataInventoryTableConfiguration	Grants permission to update the inventory table configuration on an existing S3 Metadata configuration for a specified general purpose bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
UpdateBucketMetadataJournalTableConfiguration	Grants permission to update the journal table configuration on an existing S3 Metadata configuration for a specified general purpose bucket	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
UpdateJobPriority	Grants permission to update the priority of an existing job	job*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ExistingJobOperation s3:ExistingJobPriority s3:RequestJobPriority s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
UpdateJobStatus	Grants permission to update the status for the specified job	job*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ExistingJobOperation s3:ExistingJobPriority s3:JobSuspendedCause s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write
UpdateObjectEncryption	Grants permission to update the server-side encryption type of an existing object in a general purpose bucket	accesspointobject	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id	Write
UpdateObjectEncryption		object	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:ExistingObjectTag/<key> s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id	Write
UpdateStorageLensGroup	Grants permission to update an existing S3 Storage Lens group	storagelensgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write

Permission-only actions for Amazon S3

The following actions are defined by Amazon S3 but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
InitiateReplication	Grants permission to initiate the replication process by setting replication status of an object to pending	object*	aws:ResourceTag/${TagKey} s3:BucketTag/${TagKey} s3:ResourceAccount	Write
PauseReplication	Grants permission to pause S3 Replication from target source buckets to destination buckets	bucket*	aws:ResourceTag/${TagKey} s3:authType s3:BucketTag/${TagKey} s3:destinationRegion s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256	Write

Actions

Description

Resource types (*required)

Condition keys

Access level

InitiateReplication

Grants permission to initiate the replication process by setting replication status of an object to pending

object*

aws:ResourceTag/${TagKey}

s3:BucketTag/${TagKey}

s3:ResourceAccount

Write

PauseReplication

Grants permission to pause S3 Replication from target source buckets to destination buckets

bucket*

aws:ResourceTag/${TagKey}

s3:authType

s3:BucketTag/${TagKey}

s3:x-amz-content-sha256

Write

Resource types defined by Amazon S3

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
accessgrant	arn:${Partition}:s3:${Region}:${Account}:access-grants/default/grant/${Token}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
accessgrantsinstance	arn:${Partition}:s3:${Region}:${Account}:access-grants/default	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
accessgrantslocation	arn:${Partition}:s3:${Region}:${Account}:access-grants/default/location/${Token}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
accesspoint	arn:${Partition}:s3:${Region}:${Account}:accesspoint/${AccessPointName}	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn
accesspointobject	arn:${Partition}:s3:${Region}:${Account}:accesspoint/${AccessPointName}/object/${ObjectName}	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:BucketTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn
bucket	arn:${Partition}:s3:::${BucketName}	aws:ResourceTag/${TagKey} s3:BucketTag/${TagKey}
job	arn:${Partition}:s3:${Region}:${Account}:job/${JobId}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
multiregionaccesspoint	arn:${Partition}:s3::${Account}:accesspoint/${AccessPointAlias}
multiregionaccesspointrequestarn	arn:${Partition}:s3:us-west-2:${Account}:async-request/mrap/${Operation}/${Token}
object	arn:${Partition}:s3:::${BucketName}/${ObjectName}	aws:ResourceTag/${TagKey} s3:BucketTag/${TagKey}
objectlambdaaccesspoint	arn:${Partition}:s3-object-lambda:${Region}:${Account}:accesspoint/${AccessPointName}
storagelensconfiguration	arn:${Partition}:s3:${Region}:${Account}:storage-lens/${ConfigId}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
storagelensgroup	arn:${Partition}:s3:${Region}:${Account}:storage-lens-group/${Name}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys

Condition keys for Amazon S3

Amazon S3 defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
s3:AccessGrantScope	Filters access by the grant scope of access grants grant	String
s3:AccessGrantsInstanceArn	Filters access by access grants instance ARN	ARN
s3:AccessGrantsLocationScope	Filters access by the location scope of access grants location	String
s3:AccessPointNetworkOrigin	Filters access by the network origin (Internet or VPC)	String
s3:AccessPointTag/${TagKey}	Filters access by existing access point tag key and value	String
s3:BucketTag/${TagKey}	Filters access by the tags associated with the bucket	String
s3:DataAccessPointAccount	Filters access by the Amazon Account ID that owns the access point	String
s3:DataAccessPointArn	Filters access by an access point Amazon Resource Name (ARN)	ARN
s3:ExistingJobOperation	Filters access by operation to updating the job priority	String
s3:ExistingJobPriority	Filters access by priority range to cancelling existing jobs	Numeric
s3:ExistingObjectTag/<key>	Filters access by existing object tag key and value	String
s3:InventoryAccessibleOptionalFields	Filters access by restricting which optional metadata fields a user can add when configuring S3 Inventory reports	ArrayOfString
s3:JobSuspendedCause	Filters access by a specific job suspended cause (for example, AWAITING_CONFIRMATION) to cancelling suspended jobs	String
s3:ObjectCreationOperation	Filters access by whether or not the operation creates an object	Bool
s3:RequestJobOperation	Filters access by operation to creating jobs	String
s3:RequestJobPriority	Filters access by priority range to creating new jobs	Numeric
s3:RequestObjectTag/<key>	Filters access by the tag keys and values to be added to objects	String
s3:RequestObjectTagKeys	Filters access by the tag keys to be added to objects	ArrayOfString
s3:ResourceAccount	Filters access by the resource owner Amazon Web Services account ID	String
s3:TlsVersion	Filters access by the TLS version used by the client	Numeric
s3:annotation-prefix	Filters access by the annotation name prefix specified in the request	String
s3:authType	Filters access by authentication method	String
s3:delimiter	Filters access by delimiter parameter	String
s3:deliverySourceArn	Filters access by specific delivery source Amazon Resource Name (ARN)	ARN
s3:destinationRegion	Filters access by a specific replication destination region for targeted buckets of the Amazon FIS action aws:s3:bucket-pause-replication	String
s3:if-match	Filters access by the request's 'If-Match' conditional header	String
s3:if-none-match	Filters access by the request's 'If-None-Match' conditional header	String
s3:isReplicationPauseRequest	Filters access by request made via Amazon FIS action aws:s3:bucket-pause-replication	Bool
s3:locationconstraint	Filters access by a specific Region	String
s3:logType	Filters access by specific log type, currently supports S3_SERVER_ACCESS_LOGS	String
s3:max-annotation-results	Filters access by the maximum number of annotation results requested	Numeric
s3:max-keys	Filters access by maximum number of keys returned in a ListBucket request	Numeric
s3:object-lock-legal-hold	Filters access by object legal hold status	String
s3:object-lock-mode	Filters access by object retention mode (COMPLIANCE or GOVERNANCE)	String
s3:object-lock-remaining-retention-days	Filters access by remaining object retention days	Numeric
s3:object-lock-retain-until-date	Filters access by object retain-until date	Date
s3:prefix	Filters access by key name prefix	String
s3:resourceArnBeingAuthorized	Filters access by source bucket Amazon Resource Name (ARN)	ARN
s3:signatureAge	Filters access by the age in milliseconds of the request signature	Numeric
s3:signatureversion	Filters access by the version of Amazon Signature used on the request	String
s3:versionid	Filters access by a specific object version	String
s3:x-amz-acl	Filters access by canned ACL in the request's x-amz-acl header	String
s3:x-amz-bucket-namespace	Filters access by general purpose bucket namespace type	String
s3:x-amz-content-sha256	Filters access by unsigned content in your bucket	String
s3:x-amz-copy-source	Filters access by copy source bucket, prefix, or object in the copy object requests	String
s3:x-amz-grant-full-control	Filters access by x-amz-grant-full-control (full control) header	String
s3:x-amz-grant-read	Filters access by x-amz-grant-read (read access) header	String
s3:x-amz-grant-read-acp	Filters access by the x-amz-grant-read-acp (read permissions for the ACL) header	String
s3:x-amz-grant-write	Filters access by the x-amz-grant-write (write access) header	String
s3:x-amz-grant-write-acp	Filters access by the x-amz-grant-write-acp (write permissions for the ACL) header	String
s3:x-amz-metadata-directive	Filters access by object metadata behavior (COPY or REPLACE) when objects are copied	String
s3:x-amz-object-annotation-directive	Filters access by the annotation copy directive specified in the request	String
s3:x-amz-object-if-match	Filters access by the ETag of the object version specified in the request	String
s3:x-amz-object-ownership	Filters access by Object Ownership	String
s3:x-amz-server-side-encryption	Filters access by server-side encryption	String
s3:x-amz-server-side-encryption-aws-kms-key-id	Filters access by Amazon KMS customer managed CMK for server-side encryption	ARN
s3:x-amz-server-side-encryption-customer-algorithm	Filters access by customer specified algorithm for server-side encryption	String
s3:x-amz-storage-class	Filters access by storage class	String
s3:x-amz-website-redirect-location	Filters access by a specific website redirect location for buckets that are configured as static websites	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Route 53 Resolver (route53resolver)

Amazon S3 Express (s3express)