Creating a Bucket Policy with a Template

Procedure

1. In the bucket list, click the bucket you want to operate to go to the Objects page.
2. In the navigation pane, choose Permissions > Bucket Policies.
3. Click Create.
4. Choose a policy template. For details about the parameters, see Bucket Policies and Object Policies.

   Table 1 Bucket policy templates

   Principal	Resource	Template	Actions Allowed	Advanced Settings
   All accounts	Entire bucket (including the objects in it)	Public Read	Allows anonymous users to perform the following actions on a bucket and the objects in it: GetBucketLocation (to get the bucket location) GetObject (to obtain object content and metadata) GetObjectVersion (to obtain the content and metadata of a specified object version)	Excluding the specified actions is not allowed.
   		Public Read/Write	Allows anonymous users to perform the following actions on a bucket and the objects in it: ListBucket (to list objects in the bucket and obtain the bucket metadata) ListBucketVersions (to list object versions in the bucket) GetBucketLocation (to get the bucket location) PutObject (to upload objects using PUT and POST, upload parts, initiate multipart uploads, and assemble parts) GetObject (to obtain object content and metadata) ModifyObjectMetaData (to modify object metadata) ListBucketMultipartUploads (to list multipart uploads) ListMultipartUploadParts (to list uploaded parts) AbortMultipartUpload (to abort multipart uploads) GetObjectVersion (to obtain the content and metadata of a specified object version) PutObjectAcl (to configure the object ACL) GetObjectVersionAcl (to obtain the ACL of a specified object version) GetObjectAcl (to obtain the object ACL)	Excluding the specified actions is not allowed.
   Current account/Other accounts/Delegated accounts	Entire bucket (including the objects in it)	Bucket Read-Only	Allows specified accounts to perform the following actions on a bucket and the objects in it: Get* (all GET actions) List* (all LIST actions)	Excluding the specified actions is not allowed.
   		Bucket Read/Write	Allows specified accounts to perform all actions excluding the following ones on a bucket and the objects in it: DeleteBucket (to delete the bucket) PutBucketPolicy (to configure a bucket policy) PutBucketAcl (to configure the bucket ACL)	The specified actions are excluded.
   All accounts/Current account/Other accounts/Delegated accounts	Current bucket + Specified objects	Directory Read-Only	Allows all accounts or specified accounts to perform the following actions on the current bucket and the specified resources in it: GetObject (to obtain object content and metadata) GetObjectVersion (to obtain the content and metadata of a specified object version) GetObjectVersionAcl (to obtain the ACL of a specified object version) GetObjectAcl (to obtain the object ACL) ListBucket (to list objects in the bucket and obtain the bucket metadata) ListBucketVersions (to list object versions in the bucket) GetBucketLocation (to get the bucket location) NOTE: If you apply the policy to All accounts, ListBucket and ListBucketVersions are not included in the template.	Excluding the specified actions is not allowed.
   		Directory Read/Write	Allows all accounts or specified accounts to perform the following actions on the current bucket and the specified resources in it: PutObject (to upload objects using PUT and POST, upload parts, initiate multipart uploads, and assemble parts) GetObject (to obtain object content and metadata) GetObjectVersion (to obtain the content and metadata of a specified object version) ModifyObjectMetaData (to modify object metadata) ListBucketMultipartUploads (to list multipart uploads) ListMultipartUploadParts (to list uploaded parts) AbortMultipartUpload (to abort multipart uploads) GetObjectVersionAcl (to obtain the ACL of a specified object version) GetObjectAcl (to obtain the object ACL) PutObjectAcl (to configure the object ACL) ListBucket (to list objects in the bucket and obtain the bucket metadata) ListBucketVersions (to list object versions in the bucket) GetBucketLocation (to get the bucket location)	Excluding the specified actions is not allowed.
   All accounts/Current account/Other accounts/Delegated accounts	Specified objects	Object Read-Only	Allows all accounts or specified accounts to perform the following actions on specified resources in the bucket: GetObject (to obtain object content and metadata) GetObjectVersion (to obtain the content and metadata of a specified object version) GetObjectVersionAcl (to obtain the ACL of a specified object version) GetObjectAcl (to obtain the object ACL)	Excluding the specified actions is not allowed.
   		Object Read/Write	Allows all accounts or specified accounts to perform the following actions on specified resources in the bucket: PutObject (to upload objects using PUT and POST, upload parts, initiate multipart uploads, and assemble parts) GetObject (to obtain object content and metadata) GetObjectVersion (to obtain the content and metadata of a specified object version) ModifyObjectMetaData (to modify object metadata) ListMultipartUploadParts (to list uploaded parts) AbortMultipartUpload (to abort multipart uploads) GetObjectVersionAcl (to obtain the ACL of an object version) GetObjectAcl (to obtain the object ACL) PutObjectAcl (to configure the object ACL)	Excluding the specified actions is not allowed.

5. Complete the bucket policy configuration.

   Some bucket policy templates require a configuration of principals or resources. You can also change the existing settings of a template, including the policy name, principals, resources, actions, and conditions. For details, see Bucket Policy Parameters.

6. Click Create in the lower right corner.