> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/backup-and-storage/ionos-object-storage/settings/bucket-policy/examples.md).

# Examples

Following are a few examples of common use cases and their corresponding bucket policy configurations.

{% hint style="info" %}
**Prerequisite:** You can retrieve the **Contract User ID** and **Canonical User ID** from the **Key Management** section by following the steps in the [<mark style="color:blue;">Retrieve User ID</mark>](/cloud/backup-and-storage/ionos-object-storage/how-tos/retrieve-user-id.md).
{% endhint %}

## Grant full control of the bucket to other users

To grant full control over a contract-owned bucket or a user-owned bucket and its objects to other <code class="expression">space.vars.ionos\_cloud\_object\_storage</code> users:

{% tabs %}
{% tab title="Contract-owned Buckets" %}

```bash
{
 "Version": "2012-10-17",
 "Statement": [
   {
     "Sid": "Grant Full Control",
     "Effect": "Allow",
     "Principal": {
                "AWS": [
                    "arn:aws:iam:::user/CONTRACT_USER_ID1",
                    "arn:aws:iam:::user/CONTRACT_USER_ID2"
                ]
            },
     "Action": "s3:*",
     "Resource": [
       "arn:aws:s3:::my-bucket",
       "arn:aws:s3:::my-bucket/*"
     ]
   }
 ]
}
```

{% endtab %}

{% tab title="User-owned Buckets" %}

```bash
{
 "Version": "2012-10-17",
 "Statement": [
   {
     "Sid": "Grant Full Control",
     "Effect": "Allow",
     "Principal": {
       "CanonicalUser": ["CANONICAL_USER_ID_1", "CANONICAL_USER_ID_2"]
     },
     "Action": "s3:*",
     "Resource": [
       "arn:aws:s3:::my-bucket",
       "arn:aws:s3:::my-bucket/*"
     ]
   }
 ]
}
```

{% endtab %}
{% endtabs %}

## Grant read-only access to a specific prefix

{% tabs %}
{% tab title="Contract-owned Buckets" %}
To grant read-only access to objects within a specific prefix of a contract-owned bucket to other <code class="expression">space.vars.ionos\_cloud\_object\_storage</code> users:

```bash
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GrantReadOnlyAccessToPrefix",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam:::user/CONTRACT_USER_ID1",
                    "arn:aws:iam:::user/CONTRACT_USER_ID2"
                ]
            },
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket/prefix/*",
                "arn:aws:s3:::my-bucket"
            ],
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "prefix/*"
                    ]
                }
            }
        }
    ]
}
```

{% endtab %}

{% tab title="User-owned Buckets" %}
To grant read-only access to objects within a specific prefix of a user-owned bucket to other <code class="expression">space.vars.ionos\_cloud\_object\_storage</code> users:

```bash
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "GrantReadOnlyAccessToPrefix",
      "Effect": "Allow",
      "Principal": {
         "CanonicalUser": ["CANONICAL_USER_ID_1", "CANONICAL_USER_ID_2"]
      },
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-bucket/prefix/*",
        "arn:aws:s3:::my-bucket"
      ],
      "Condition": {
        "StringLike": {
          "s3:prefix": [
            "prefix/*"
          ]
        }
      }
    }
  ]
}
```

{% endtab %}
{% endtabs %}

## Public read access

To allow read access to certain objects within a contract-owned bucket or a user-owned bucket while keeping other objects private:

```bash
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicRead",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/public/*"
    }
  ]
}
```

## Restrict access to specific IP addresses

To restrict all users from performing any S3 operations within the designated bucket type, unless the request is initiated from the specified range of IP addresses:

```bash
{
    "Id": "SourceIp",
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SourceIp",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ],
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": [
                        "123.123.123.0/24"
                    ]
                }
            }
        }
    ]
}
```

For more information on bucket policy configurations, see [<mark style="color:blue;">Bucket Policy</mark>](/cloud/backup-and-storage/ionos-object-storage/settings/bucket-policy.md), supported bucket and object [<mark style="color:blue;">actions and condition values</mark>](https://docs.ionos.com/cloud/api-reference/storage-and-backup/ionos-object-storage/ionos-object-storage-for-user-owned-buckets/policy/), and [<mark style="color:blue;">Retrieve user ID</mark>](/cloud/backup-and-storage/ionos-object-storage/how-tos/retrieve-user-id.md#retrieve-user-id).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.ionos.com/cloud/backup-and-storage/ionos-object-storage/settings/bucket-policy/examples.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.