---
title: How to create and manage bucket policies using the console
description: Create and apply bucket policies for Object Storage.
tags: bucket policy bucket console object storage aws-s3 access
dates:
validation: 2025-06-09
posted: 2024-05-30
---
import Requirements from '@macros/iam/requirements.mdx'
import StorageBucketPolicy from '@macros/storage/bucket-policy.mdx'
import ImportantBucketPolicy from '@macros/storage/important-bucket-policy.mdx'
Scaleway Object Storage allows you to create [bucket policies](/object-storage/concepts/#bucket-policy) directly from the [Scaleway console](https://console.scaleway.com).
To create and apply a bucket policy from the AWS CLI, refer to the [dedicated documentation](/object-storage/api-cli/create-bucket-policy/).
- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- [Created a bucket](/object-storage/how-to/create-a-bucket/)
## How to create a bucket policy
1. Click **Object Storage** on the left side menu of the console. The Object Storage dashboard displays.
2. Click the **Bucket policies** tab, then click **+ Create bucket policy**. A creation form displays.
3. Enter a name for your bucket policy.
4. Select the bucket to which you want to apply the policy.
- You can only apply a policy to a single bucket, but you can [duplicate an existing policy](/object-storage/how-to/create-bucket-policy/#how-to-apply-an-existing-policy-to-another-bucket) and apply it to another bucket.
- If you change the target bucket of an existing policy, the bucket policy will be removed from the original bucket, and applied to the selected bucket.
5. Select your preferred creation method:
- The **policy generator** to add [statements](/object-storage/api-cli/bucket-policy/#statement) using a form.
- The **JSON editor** to manually write or paste your bucket policy in a code editor.
Refer to the dedicated documentation on [bucket policies overview](/object-storage/api-cli/bucket-policy/) and [combining IAM and bucket policies](/object-storage/api-cli/combining-iam-and-object-storage/) for more information on how to build a bucket policy.
6. Keep the **Maintain access to bucket** box ticked to prevent accidental lockout from your bucket. By default, the bucket policy contains a **secure statement** that allows every action to the user creating the policy.
7. Create a [statement](/object-storage/api-cli/bucket-policy/#statement) by entering the following information:
- Enter a unique [statement ID](/object-storage/api-cli/bucket-policy/#sid) (also called **Sid**) describing the purpose of the statement.
- Select the types of [principals](/object-storage/api-cli/bucket-policy/#principal) of your bucket policy from the drop-down menu.
- Select the **users** and **applications** you want to grant access to.
- Select the [Actions](/object-storage/api-cli/bucket-policy/#action) to allow to the principal(s).
To allow different action sets to the different principals, create multiple statements.
- Select [resources](/object-storage/api-cli/bucket-policy/#resource) by entering the prefix of the objects, followed by `/*`. Enter `*` to select every object in the bucket.
- Add [conditions](/object-storage/api-cli/bucket-policy/#condition) by selecting by selecting them from the drop-down menu, and adding a supported key-value pair.
- Enter a unique [statement ID](/object-storage/api-cli/bucket-policy/#sid) (also called **Sid**) describing the purpose of the statement.
- Enter the types of [principals](/object-storage/api-cli/bucket-policy/#principal) and the user/application ID you want to grant access as shown below:
```json
"Principal":{
"SCW":[
"user_id:",
"application_id:"
]
},
```
- Enter the [Actions](/object-storage/api-cli/bucket-policy/#action) to allow to the principal(s) as shown below. Enter `s3:*` to allow all actions.
```json
"Action":[
"s3:ListBucket",
"s3:GetObject"
],
```
To allow different action sets to the different principals, create multiple statements.
- Grant access to [resources](/object-storage/api-cli/bucket-policy/#resource) by entering the prefix of the objects as shown below. Enter `*` to select every object in the bucket.
```json
"Resource":[
"",
"/photos/*"
]
```
Add the bucket as a resource to allow operations on the bucket, such as `s3:ListBucket`.
- Add [conditions](/object-storage/api-cli/bucket-policy/#condition) as shown below:
```json
"Condition": {
"DateGreaterThan": {
"aws:CurrentTime": "2020-01-01T00:00:00Z"
},
"StringLike": {
"aws:Referer": "https://console.scaleway.com/*"
},
"IpAddress": {
"aws:SourceIp": "192.0.2.0/24"
}
}
```
8. (Optional) Click **+ Add statement**, and repeat the previous step to add another statement to your bucket policy.
9. Review your bucket policy using the JSON preview.
10. Click **Create bucket policy** to create it, and apply it to the selected bucket.
## Bucket policy example
Below is an example of a bucket policy generated using the console. For more information on each element of a bucket policy, refer to the [dedicated documentation](/object-storage/api-cli/bucket-policy/).
```json
{
"Id": "my-bucket-policy",
"Version": "2023-04-17",
"Statement": [
{
"Principal": {
"SCW": [
"user_id:example-c5cc-4862-8506-e09dfe5b9d1c",
"application_id:example-3967-f6rc-2064-b9d1ce09dfe5",
]
},
"Sid": "my-statement-1",
"Action": [
"s3:DeleteObject",
"s3:DeleteObjectTagging",
"s3:GetBucketTagging",
"s3:GetObject"
],
"Effect": "Allow",
"Resource": [
"my-bucket",
"my-bucket/photos/*"
],
"Condition": {
"IpAddress": {
"aws:SourceIp": "192.0.2.0/24"
}
}
},
{
"Principal": {
"SCW": [
"application_id:example-c5cc-4862-8506-e0969drses3d"
]
},
"Sid": "my-statement-2",
"Action": [
"s3:PutObject",
"s3:PutBucketTagging",
"s3:PutBucketVersioning"
],
"Effect": "Allow",
"Resource": [
"my-bucket",
"my-bucket/documents/*"
],
"Condition": {
"StringLike": {
"aws:Referer": "https://console.scaleway.com/*"
}
}
}
]
}
```
## How to edit a bucket policy
1. Click **Object Storage** on the left side menu of the console. The Object Storage dashboard displays.
2. Click the **Bucket policies** tab.
3. Click the name of the bucket policy you want to edit.
4. Click **Edit policy**.
Alternatively, you can also edit a bucket policy from the **Settings tab** of your bucket, or by clicking next to its name in the **Bucket policies** tab.
## How to apply an existing policy to another bucket
The [Scaleway console](https://console/scaleway.com) allows you to duplicate an existing policy, and apply it to another bucket.
1. Click **Object Storage** on the left side menu of the console. The Object Storage dashboard displays.
2. Click the **Bucket policies** tab.
3. Click the name of the bucket policy you want to apply to another bucket.
4. Click **Apply to another bucket**. A pop-up appears.
5. Select a bucket from the drop-down menu, then enter a name for the policy.
6. Click **Apply policy**.
## How to delete a bucket policy
1. Click **Object Storage** on the left side menu of the console. The Object Storage dashboard displays.
2. Click the **Bucket policies** tab.
3. Click the name of the bucket policy you want to delete.
4. Click **Delete policy** to permanently delete it.
Alternatively, you can also delete a bucket policy by clicking next to its name in the **Bucket policies** tab.
## Troubleshooting
- If you accidentally lost access to your bucket after applying a bucket policy, refer to the [dedicated troubleshooting page](/object-storage/troubleshooting/lost-bucket-access-bucket-policy/).
- If an error displays upon validating your bucket policy, make sure that it is properly formatted. Refer to the [bucket policies overview](/object-storage/api-cli/bucket-policy/) for more information on the syntax of each element.