Contact UsGet started
Yandex Object Storage

Data schema

Written by
Updated at August 2, 2024

Data schema in JSON format:

{
  "Version" : "string",
  "Id" : "string",
  "Statement" : [
    {
      "Sid" : "string",
      ("Principal" | "NotPrincipal") : ("*" | "CanonicalUser" : [
        "string",
        ...
      ]),
      "Effect" : ("Allow" | "Deny"),
      "Action" : ("*" | [
        "string",
        ...
      ]),
      "Resource" : ("*" | [
        "string",
        ...
      ]),
      "Condition" : {
        "condition_type_string" : {
          "condition_key_string" : [[("string" | "number" | "Boolean"),...]...]
        },
        ...
      }  
    },
    ...
  ]
}

A schema can include up to 10,240 characters.

Description of schema parameters:

Parameter Description
Version (Optional) string
Access policy description version.
Sample value: 2012-10-17.
Id (Optional) string
General information about the policy. Some Yandex Cloud services require this value to be unique.
The parameter is user-defined.
Examples: test-policy, Anonymous access policy, or hrtk43sau2s8gqkaje06.
Statement[]. array
Bucket policy rules.
If a bucket policy with no rules is applied to the bucket, access is denied to all users. To disable request verification for a bucket policy, delete it.
Statement[].Sid string
(Optional) Rule ID.
The parameter is user-defined.
Examples: test-rule, Statement Allow, or Statement Deny.
Statement[].Principal string
(Optional) Requested permission subject ID. The possible recipients are a user, service account, or user group.
The possible values are * and <subject_ID>.
You can specify a user group in the policy using the Yandex Cloud CLI, AWS CLI, Terraform, and the API.
Statement[].NotPrincipal string
(Optional) ID of the subject that will not receive the requested permission. The possible recipients are a user, service account, or user group.
The possible value is <subject_ID>.
You can specify a user group in the policy using the Yandex Cloud CLI, AWS CLI, Terraform, and the API.
Statement[].Effect string
Specifies whether the requested action is denied or allowed.
Possible values: Allow, Deny.
Statement[].Action string
Determines the action to be executed when the policy is triggered.
Possible values: s3:GetObject, s3:PutObject.
Statement[].Resource string
Specifies the resource that the action will be performed on.
Possible values:
  • arn:aws:s3:::<bucket_name>: Bucket.
  • arn:aws:s3:::<bucket_name>/<object_key>: Bucket object.
  • arn:aws:s3:::<bucket_name>/<object_key_prefix>*: All bucket objects with keys having a prefix, e.g., arn:aws:s3:::samplebucket/some/path/*. A prefix can be empty, e.g., arn:aws:s3:::samplebucket/*; in this case, the rule will apply to all bucket objects.
A bucket resource does not include resources of all its objects. To make sure a bucket policy rule refers to the bucket and all objects, specify them as separate resources, e.g., arn:aws:s3:::samplebucket and arn:aws:s3:::samplebucket/*.
Statement[].Condition{}. string
(Optional) Condition that will be checked.
Statement[].Condition{}.
condition_type_string{}.		 string
Condition type.
Possible values: StringEquals, Bool. For a full list of values, see Comparison operators.
Statement[].Condition{}.
condition_type_string{}.
condition_key_string		 string
Specifies the condition whose value will be checked.
Possible values: aws:PrincipalType, true.

See also

Previous
DeleteBucketPolicy
Next
Actions