How to use the AWS S3 Bucket Policy Generator
- 1. Enter the bucket nameType the exact bucket name. The tool checks AWS naming rules.
- 2. Choose the purposeHTTPS only, public website, another account, or CloudFront.
- 3. Paste into S3Open the bucket's Permissions tab and paste under Bucket policy.
The default policy explained
With the default bucket my-site-assets-2026 and HTTPS only selected, you get one statement named DenyInsecureTransport. It denies every S3 action to every principal when aws:SecureTransport is false, on both the bucket ARN and the objects ARN. Because it is a Deny, it overrides any Allow elsewhere, so plain HTTP requests are refused even for users who otherwise have access. Many security checklists ask for exactly this statement.
The other scenarios add an Allow statement in front of it: s3:GetObject for everyone for a public website, GetObject and ListBucket for a named role in another account, or GetObject for the CloudFront service principal limited by AWS:SourceArn to your distribution.
Choosing between public and CloudFront
A public-read bucket is the quickest way to host a static site, but every object becomes downloadable by anyone, and you must switch off Block Public Access for that bucket. Serving through CloudFront with Origin Access Control keeps the bucket private, adds HTTPS on your own domain and caches files at edge locations. For most new sites the CloudFront option is the better default.
- Bucket names are 3 to 63 lowercase characters, numbers, dots and hyphens, and must not look like an IP address.
- The object ARN ends in
/*; the bucket ARN does not. - The other account in a cross-account setup must also allow the same actions in its own IAM policy.
For permissions attached to users and roles rather than buckets, use the IAM policy generator.
Frequently asked questions
Why do I get Access Denied after adding a public policy?
Block Public Access is probably still on for the bucket or account. It overrides public bucket policies until you turn it off for that bucket.
Can I combine several scenarios?
Yes. Generate each one and merge the statements into one Statement array. Each statement needs a unique Sid.
Is the AWS S3 Bucket Policy Generator free?
Yes, the AWS S3 Bucket Policy Generator is free. The first time you generate your first bucket policy, you are asked for your name and WhatsApp number once. After that, this and every other Uncodemy tool opens straight away without the form.