Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am wanting to create a S3 bucket that does not allow for the deletion of files.

Does anyone know how I am able to achieve this?

share|improve this question

closed as too localized by dunxd, MadHatter, John Gardeniers, mdpc, Scott Pack Nov 13 '12 at 21:39

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

How does S3 know when you've finished writing? –  womble Aug 1 '12 at 10:33
@womble - I see a problem in the wording, thanks. I have updated the question. –  Kyle Rozendo Aug 1 '12 at 11:00
Do you mean you want a particular user not to be allowed to delete files? Someone must be able to delete the files. –  John Wheal Aug 1 '12 at 11:20
@JohnWheal: Not necessarily -- you may want to have a truly append-only bucket. There are ways around that (like deleting the bucket, or cancelling the AWS account) but for relatively "tamper-proof" backup purposes, I could see it being of some use. –  womble Aug 1 '12 at 12:13
@womble - that is exactly it. To make a mostly tamper-proof bucket. If it is possible to make an append-only bucket, that is definitely ideal. Any idea? –  Kyle Rozendo Aug 4 '12 at 17:17

1 Answer 1

You can't toggle a flag on a bucket to say "this bucket can never be deleted or its contents deleted", because to be effective, the flag would have to prevent the account owner from doing any of those things -- which would mean you could never cancel your account. Not cool.

However, AWS has the ability to provide limited-permission principals, which can be granted a subset of permissions to an AWS resource. This is known as "IAM -- Identity and Access Management", and under this scheme the login details for the AWS account itself would be kept under tight lock-and-key (rather than handed out to everyone in the company willy-nilly), and only the restricted credentials would be handed around like a doobie on a teenage camping trip.

I don't have a lot of first-hand experience with IAM and S3, but through a brief dalliance with the IAM policy generator, it would appear to me that a policy that looked something like the following might work:

  "Id": "Policy1344116539061",
  "Statement": [
      "Sid": "Stmt1344116519156",
      "Action": [
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::mybucket/*",
      "Principal": {
        "AWS": [

I'd definitely be testing that to make sure it didn't allow anything you don't want it to (for instance, I'm not 100% sure that s3:PutObject doesn't allow the overwriting of existing objects), and you'll still have to learn how to apply the policy (for which the IAM user guide or perhaps the IAM API reference may be able to assist -- or, if those fail to illuminate, ask a detailed question here and someone may have sufficient IAM fu to be able to point you in the right direction), but at least you've got a pointer in the right direction now.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.