---
title: Creating and applying a bucket policy
description: Create custom bucket policies in Scaleway Object Storage using the CLI.
tags: bucket policy bucket bucket-policy object storage object-storage s3
dates:
  validation: 2025-11-18
  posted: 2021-01-17
---
import Requirements from '@macros/iam/requirements.mdx'
import StorageBucketPolicy from '@macros/storage/bucket-policy.mdx'
import ImportantBucketPolicy from '@macros/storage/important-bucket-policy.mdx'


<StorageBucketPolicy />

To create and apply a bucket policy from the [Scaleway console](https://console/scaleway.com), refer to the [dedicated documentation](/object-storage/how-to/create-bucket-policy/).

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- An [Object Storage bucket](/object-storage/how-to/create-a-bucket/)
- Installed and configured the [AWS CLI](/object-storage/api-cli/object-storage-aws-cli/) using a Scaleway API key
- An [IAM policy](/iam/how-to/create-policy/) to grant access to your users and applications

## How to create a bucket policy

1. Create a `bucket-policy.json` file.

2. Open it in a code editor and paste the code below inside. This sample bucket policy contains a statement that **only allows the specified user** to see the bucket and the objects it contains.
    ```json
    {
        "Version": "2023-04-17",
        "Id": "MyBucketPolicy",
        "Statement": [
            {
                "Sid": "DelegateAccess",
                "Effect": "Allow",
                "Principal": {
                    "SCW": "user_id:<USER_ID>"
                },
                "Action": [
                    "s3:ListBucket",
                    "s3:GetObject"
                ],
                "Resource": [
                    "<BUCKET_NAME>",
                    "<BUCKET_NAME>/*"
                ]
            }
        ]
    }
    ```
3. Replace the `<USER_ID>` placeholder with the ID of the user to which you want to grant access. You can also grant access to an [application](/object-storage/api-cli/bucket-policy/#principal).
4. Replace the `<BUCKET_NAME>` placeholders with the name of the concerned bucket. Refer to the [resource documentation](/object-storage/api-cli/bucket-policy/#resource) for more information.

<Message type="note">
Refer to the [Bucket policies description](/object-storage/api-cli/bucket-policy/#bucket-policies-description) for more details on each string.
</Message>

## How to apply a bucket policy

Make sure that you have [installed and configured the AWS CLI](/object-storage/api-cli/object-storage-aws-cli/) before proceeding.

1. Open a terminal and access the folder containing the previously created `bucket-policy.json` file.

2. Run the command below to apply the policy. Make sure to replace `<BUCKET_NAME>` with the name of your bucket.
    ```bash
    aws s3api put-bucket-policy --bucket <BUCKET_NAME> --policy file://bucket-policy.json
    ```
    <ImportantBucketPolicy />
3. Run the command below to display the bucket policy applied to your bucket.
    ```bash
    aws s3api get-bucket-policy --bucket <BUCKET_NAME> --query Policy --output text | jq
    ```
    An output similar to the following displays:
    ```json
    {
      "Version": "2023-04-17",
      "Id": "MyBucketPolicy",
      "Statement": [
        {
          "Sid": "DelegateAccess",
          "Effect": "Allow",
          "Action": [
            "s3:ListBucket",
            "s3:GetObject"
          ],
          "Principal": {
            "SCW": "user_id:f3e2-example-8e51-0fd3299d5d70"
          },
          "Resource": [
            "my-bucket",
            "my-bucket/*"
          ]
        }
      ]
    }
    ```

## How to delete a bucket policy

<Message type="note">
To delete a bucket policy, you must have [Owner](/iam/concepts/#owner) status, or the necessary [IAM permissions](/object-storage/reference-content/s3-iam-permissions-equivalence/).
</Message>

Run the command below to delete the policy of a specific bucket. Replace `<BUCKET_NAME>` with the name of your bucket.

    ```bash
    aws s3api delete-bucket-policy --bucket <BUCKET_NAME>
    ```

<Message type="important">
Your objects will become accessible to all the users in your Organization that have [IAM permissions](/object-storage/api-cli/combining-iam-and-object-storage/#combining-iam-and-bucket-policies) for Object Storage.
</Message>