Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There's a bucket into which some users may write their data for backup purposes.

They use s3cmd to put new files into their bucket.

I'd like to enforce a non-destruction policy on these buckets - meaning, it should be impossible for users to destroy data, they should only be able to add data.

How can I create a bucket policy that only lets a certain user put a file if it doesn't already exist, and doesn't let him do anything else with the bucket.

share|improve this question
up vote 2 down vote accepted

Consider enabling versioning for the bucket. That way users can change and delete what they want, but no data is never really deleted, except by specific calls to delete old versions. Also, there is the possibility of enabling MFA delete, which means you will need a multi-factor authentication token to be able to permanently delete anything.

share|improve this answer
great suggestion, thanks. too bad they don't have support for this feature in their console - you have to code to turn it on (or use some 3rd party explorer). – Assaf Lavie Apr 15 '12 at 7:16
Agreed, this should be in their management console. – Nakedible Apr 15 '12 at 12:35

You can use amazons policy generator to easily generate new policies.

You can easily give someone permissions to ListBuckets and PutObject only. The problem is that PutObject can also update the objects. I'm not sure of any way that you can separate the two using a policy. As long as your ok with users being able to update and add then the policy is pretty simple.

  "Id": "Policy1334428511844",
  "Statement": [
      "Sid": "Stmt1334428508621",
      "Action": [
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::<bucket>\<folder>",
      "Principal": {
        "AWS": [

] }

share|improve this answer
That dog won't hunt. The idea is to make it impossible to destroy data. – Assaf Lavie Apr 15 '12 at 7:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.