---
title: "Configuring Bucket Policies in S3 | Hostman Docs"
description: "Secure S3-compatible storage with bucket policies. This guide shows how to restrict access via HTTPS, allow specific IP addresses, and control object-level permissions using prefix-based rules and AWS CLI."
---

> For the complete documentation index for AI agents, see [llms.txt](https://hostman.com/llms.txt).

[S3](https://hostman.com/products/s3-storage/) access management features enable flexible configuration of access rules for various use cases. Below are some useful examples of S3 bucket policy configurations.

## Restricting Access to HTTPS Only

To secure data transmission, you can restrict bucket access to HTTPS connections only. This prevents access attempts using unsecured HTTP requests, reducing the risk of data compromise.

1.  Create a policy file named `ssl.json`:
    

```shell
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::<bucket_name>/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        }
    ]
}
```

2.  Apply the policy using the following command:
    

```shell
aws s3api put-bucket-policy --bucket <bucket_name> --policy file://ssl.json --endpoint-url https://s3.hmstorage.net
```

Now, any HTTP requests will return a 403 error.

## Restricting Access by IP Addresses

To enhance security, you can limit bucket access to specific IP addresses. This is useful for protecting data from unauthorized external access.

1.  Create a policy file named `ip.json`:
    

```shell
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::<bucket_name>/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": [
                        "<IP_address>"
                    ]
                }
            }
        }
    ]
}
```

2.  Apply the policy using the following command:
    

```shell
aws s3api put-bucket-policy --bucket <bucket_name> --policy file://ip.json --endpoint-url https://s3.hmstorage.net
```

## Granting Access to a Specific Prefix

If you need to provide access to specific objects in a bucket, such as files under a certain prefix, use the following policy. This is ideal for private buckets to allow access only to specific data.

1.  Create a policy file named `prefix.json`:
    

```shell
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::<bucket_name>/html/*"
        }
    ]
}
```

2.  Apply the policy using the following command:
    

```shell
aws s3api put-bucket-policy --bucket <bucket_name> --policy file://prefix.json --endpoint-url https://s3.hmstorage.net
```

Now, all files under the `/html` prefix will be accessible for reading.