yandex_storage_bucket_policy (Resource)
Written by
Updated at February 9, 2026
Allows management of policy of an existing Yandex Cloud Storage Bucket.
Warning
By default, for authentication, you need to use IAM token with the necessary permissions.
Warning
Alternatively, you can provide static access keys (Access and Secret). To generate these keys, you will need a Service Account with the appropriate permissions.
Warning
"Version" element is required and must be set to 2012-10-17.
Example usage
provider "yandex" {
cloud_id = "<my_cloud_id>"
folder_id = "<my_folder_id>"
storage_access_key = "<my_storage_access_key>"
storage_secret_key = "<my_storage_secret_key>"
token = "<my_iam_token>"
}
resource "yandex_storage_bucket_policy" "my_policy_0" {
bucket = "my_bucket_name_0"
policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::my-policy-bucket/*",
"arn:aws:s3:::my-policy-bucket"
]
},
{
"Effect": "Deny",
"Principal": "*",
"Action": "s3:PutObject",
"Resource": [
"arn:aws:s3:::my-policy-bucket/*",
"arn:aws:s3:::my-policy-bucket"
]
}
]
}
POLICY
}
Arguments & Attributes Reference
access_key(String). The access key to use when applying changes. This value can also be provided asstorage_access_keyspecified in provider config (explicitly or withinshared_credentials_file) is used.bucket(Required)(String). The name of the bucket.policy(Required)(String). The text of the policy.secret_key(String). The secret key to use when applying changes. This value can also be provided asstorage_secret_keyspecified in provider config (explicitly or withinshared_credentials_file) is used.
Import
The resource can be imported by using their resource ID. For getting it you can use Yandex Cloud Web Console or Yandex Cloud CLI.
# The resource can be imported by using their resource ID.
# For getting a resource ID you can use Yandex Cloud Web UI or YC CLI.
# terraform import yandex_storage_bucket_policy.<resource_name> resource_id
terraform import yandex_storage_bucket_policy.<resource_name> ...