Processed locally in your browser — not uploaded
S3 Bucket Policy Generator
Build a valid AWS S3 bucket policy JSON document by toggling common statements — public read access, CloudFront Origin Access Control (OAC), cross-account access, and deny-insecure-transport (enforce HTTPS) — instead of hand-writing IAM JSON. Each statement follows AWS's own documented policy patterns, including the OAC AWS:SourceArn condition and the ListBucket-vs-object-actions resource split. Generated entirely in your browser.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "PublicReadGetObject",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-static-site-2026/*"
},
{
"Sid": "DenyInsecureTransport",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::my-static-site-2026",
"arn:aws:s3:::my-static-site-2026/*"
],
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
}
]
}How to use
- Enter your S3 bucket name, then toggle on the statements you need: public read access, CloudFront Origin Access Control (OAC), cross-account access, and/or deny-insecure-transport (enforce HTTPS).
- Public read and cross-account statements accept an optional key prefix (e.g. public/*) to scope access to part of the bucket instead of the whole thing.
- CloudFront OAC needs your AWS account ID and CloudFront distribution ID — the generated statement matches AWS's documented OAC pattern using the AWS:SourceArn condition.
- Copy the generated JSON into the S3 console's Bucket Policy editor, or paste it into your Terraform/CloudFormation/CDK bucket policy resource.
Understanding the output
Each toggle adds one IAM policy statement to a single Version 2012-10-17 policy document. Statements follow AWS's own documented patterns: object-level actions (GetObject, PutObject, DeleteObject) apply to the bucket/* ARN, while ListBucket applies to the bucket ARN itself — mixing the two in one statement is a common source of "access denied" surprises this tool avoids by splitting them automatically.
Common issues & tips
- •"Access Denied" after applying a public-read policy: check that S3 Block Public Access settings (at the bucket or account level) aren't overriding the bucket policy — they take precedence.
- •CloudFront still gets 403s after switching to OAC: the CloudFront distribution's origin must have Origin Access Control enabled and pointed at this exact bucket policy's distribution ARN.
- •Deny-insecure-transport blocks the AWS CLI/console unexpectedly: this is a Deny statement, so it overrides any Allow for the same request — it correctly blocks all plain-HTTP access including some internal AWS service calls that don't use HTTPS.
Frequently asked questions
- Does this tool send my bucket name or AWS account ID anywhere?
- No. The policy JSON is generated entirely in your browser using JavaScript — nothing you enter is sent to a server.
- Why does my public-read policy still return Access Denied?
- S3 Block Public Access settings, at either the bucket or account level, override a bucket policy that allows public access. Disable the relevant Block Public Access setting for a public-read policy to take effect.
Related tools
CIDR Calculator
Calculate network address, broadcast address, usable host range and subnet mask from CIDR notation.
Database Connection String Parser & Builder
Parse and rebuild PostgreSQL, MySQL, MongoDB, Redis, and RabbitMQ connection strings.
AWS CloudFront Access Log Parser
Parse AWS CloudFront CDN access logs for Cache Hit Ratios, edge latency percentiles, and top URIs.