Answers: <p>Yes, <strong>Resource</strong> is a required element on S3 bucket policies. If the resource is omitted, the API will respond with an error resembling this one below.</p>
  
  <pre><code>status code: 400
  Error putting S3 policy: MalformedPolicy: Statement is missing required element
  </code></pre>
  
  <p>The reasoning is that each statement could apply to the bucket itself, the contents of the bucket, or some subset of the bucket contents, and it's up to the user to clarify. In theory AWS could provide a default that includes both the bucket and all of its contents, but that design probably wasn't chosen because it makes it too easy to accidentally make the bucket policies broader than expected.</p>
  
  <p>Additionally, it is <strong>not permissible</strong> to use a wildcard in the resource element of an S3 bucket policy. Attempts to do so will yield an error such as this:</p>
  
  <pre><code>Error putting S3 policy: MalformedPolicy: Policy has invalid resource
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2019-06-26T00:34:31.797Z
Answers: Have you found any documentation _why_ a wildcard isn't allowed? It seems like its meaning would be valid
Answers: Mike Lutz
Answers: CC BY-SA 4.0
Answers: 2019-03-04T18:46:34.720Z
Answers: 2019-03-04T18:52:01.400Z
Answers: 2019-03-04T18:52:01.400Z
Answers: Nic
Body: <p>Is it necessary to specify a <strong>resource</strong> attribute within the statements that make up an S3 bucket policy? The <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html" rel="noreferrer">Access Policy Language Overview</a> seems to suggest that the resource attribute is always included, though it doesn't come straight out and say it's <em>required</em>. Consider this example policy shown on the language overview page.</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Id": "ExamplePolicy01",
    "Statement": [
      {
        "Sid": "ExampleStatement01",
        "Effect": "Allow",
        "Principal": {
          "AWS": "arn:aws:iam::Account-ID:user/Dave"
        },
        "Action": [
          "s3:GetObject",
          "s3:GetBucketLocation",
          "s3:ListBucket"
        ],
        "Resource": [
          "arn:aws:s3:::examplebucket/*",
          "arn:aws:s3:::examplebucket"
        ]
      }
    ]
  }
  </code></pre>
  
  <p>A bucket policy is assigned to an S3 bucket, so it seems like the policy would always be evaluated in the context of the bucket that it's assigned to. Based on that, it seems like it should be possible to omit the <strong>resource</strong> attribute.</p>
  
  <p>If the resource attribute really is required, is it possible to use a wildcard arn like this? Would that carry any risks, or would it simply allow access to the bucket exactly as if the bucket was named in the policy?</p>
  
  <pre><code>      "Resource": [
          "arn:aws:s3:::*",
          "arn:aws:s3:::*/*"
        ]
  </code></pre>
  
  <p><em>(For greater clarity, I am NOT talking about IAM policies in this question.)</em></p>
  
Tags: <amazon-web-services><amazon-s3>
Title: Is it necessary to specify resource in S3 Bucket Policies?
UserDisplayName: Nic
ThreadText: # Is it necessary to specify resource in S3 Bucket Policies?
  
  (Asked by: username_0 on 2019-03-01)
  
  Is it necessary to specify a **resource** attribute within the statements that make up an S3 bucket policy? The [Access Policy Language Overview](https://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html) seems to suggest that the resource attribute is always included, though it doesn't come straight out and say it's *required*. Consider this example policy shown on the language overview page.
  
  ```
  {
    "Version": "2012-10-17",
    "Id": "ExamplePolicy01",
    "Statement": [
      {
        "Sid": "ExampleStatement01",
        "Effect": "Allow",
        "Principal": {
          "AWS": "arn:aws:iam::Account-ID:user/Dave"
        },
        "Action": [
          "s3:GetObject",
          "s3:GetBucketLocation",
          "s3:ListBucket"
        ],
        "Resource": [
          "arn:aws:s3:::examplebucket/*",
          "arn:aws:s3:::examplebucket"
        ]
      }
    ]
  }
  
  ```
  
  A bucket policy is assigned to an S3 bucket, so it seems like the policy would always be evaluated in the context of the bucket that it's assigned to. Based on that, it seems like it should be possible to omit the **resource** attribute.
  
  If the resource attribute really is required, is it possible to use a wildcard arn like this? Would that carry any risks, or would it simply allow access to the bucket exactly as if the bucket was named in the policy?
  
  ```
        "Resource": [
          "arn:aws:s3:::*",
          "arn:aws:s3:::*/*"
        ]
  
  ```
  
  *(For greater clarity, I am NOT talking about IAM policies in this question.)*
  
  **Tags:** amazon-web-services, amazon-s3
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2019-03-04. Score: 5 | Accepted answer
  
  Yes, **Resource** is a required element on S3 bucket policies. If the resource is omitted, the API will respond with an error resembling this one below.
  
  ```
  status code: 400
  Error putting S3 policy: MalformedPolicy: Statement is missing required element
  
  ```
  
  The reasoning is that each statement could apply to the bucket itself, the contents of the bucket, or some subset of the bucket contents, and it's up to the user to clarify. In theory AWS could provide a default that includes both the bucket and all of its contents, but that design probably wasn't chosen because it makes it too easy to accidentally make the bucket policies broader than expected.
  
  Additionally, it is **not permissible** to use a wildcard in the resource element of an S3 bucket policy. Attempts to do so will yield an error such as this:
  
  ```
  Error putting S3 policy: MalformedPolicy: Policy has invalid resource
  
  ```
  
  > **Comments:**
  > **username_1**: Have you found any documentation _why_ a wildcard isn't allowed? It seems like its meaning would be valid  
  
  ---
  
  