There's a bucket into which some users may write their data for backup purposes.

They use s3cmd to put new files into their bucket.

I'd like to enforce a non-destruction policy on these buckets - meaning, it should be impossible for users to destroy data, they should only be able to add data.

How can I create a bucket policy that only lets a certain user put a file if it doesn't already exist, and doesn't let him do anything else with the bucket.


Consider enabling versioning for the bucket. That way users can change and delete what they want, but no data is never really deleted, except by specific calls to delete old versions. Also, there is the possibility of enabling MFA delete, which means you will need a multi-factor authentication token to be able to permanently delete anything.

  • great suggestion, thanks. too bad they don't have support for this feature in their console - you have to code to turn it on (or use some 3rd party explorer). – Assaf Lavie Apr 15 '12 at 7:16
  • Agreed, this should be in their management console. – Nakedible Apr 15 '12 at 12:35

You can use amazons policy generator to easily generate new policies.


You can easily give someone permissions to ListBuckets and PutObject only. The problem is that PutObject can also update the objects. I'm not sure of any way that you can separate the two using a policy. As long as your ok with users being able to update and add then the policy is pretty simple.

  "Id": "Policy1334428511844",
  "Statement": [
      "Sid": "Stmt1334428508621",
      "Action": [
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::<bucket>\<folder>",
      "Principal": {
        "AWS": [

] }

  • 1
    That dog won't hunt. The idea is to make it impossible to destroy data. – Assaf Lavie Apr 15 '12 at 7:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.