Amazon S3 的動作、資源和條件索引鍵

Amazon S3 (服務字首：s3) 提供以下專屬於服務的資源、動作和條件內容金鑰，供 IAM 許可政策中使用。

參考資料：

了解如何設定此服務。
檢視可供此服務使用的 API 操作清單。
了解如何使用 IAM 許可政策來保護此服務及其資源。

主題

Amazon S3 定義的動作
Amazon S3 定義的資源類型
Amazon S3 的條件索引鍵

Amazon S3 定義的動作

您可在 IAM 政策陳述式的 Action 元素中指定以下動作。使用政策來授予在 AWS中執行操作的許可。在政策中使用動作時，通常會允許或拒絕存取相同名稱的 API 操作或 CLI 命令。不過，在某些情況下，單一動作可控制對多個操作的存取。或者，某些操作需要多種不同的動作。

動作資料表的存取層級欄說明動作的分類方式（列出、讀取、許可管理或標記）。此分類可協助您了解在政策中使用某動作時，該動作授予您的存取層級。如需存取層級的詳細資訊，請參閱政策摘要中的存取層級。

「動作」資料表的資源類型欄會指出每個動作是否支援資源層級的許可。如果此欄沒有值，您必須在政策陳述式的 Resource 元素中指定政策適用的所有資源 ("*")。如果資料欄包含資源類型，則您可以在具有該動作的陳述式中指定該類型的 ARN。如果動作具有一或多個必要資源，呼叫者必須具有對這些資源使用動作的許可。表格中的必要資源會以星號 (*) 表示。如果您使用 IAM 政策中的 Resource 元素限制資源存取，則每種必要的資源類型必須要有 ARN 或模式。某些動作支援多種資源類型。如果資源類型是選用 (未顯示為必要)，則您可以選擇使用其中一種選用資源類型。

「動作」資料表的條件索引鍵欄包含您可以在政策陳述式的 Condition 元素中指定的索引鍵。如需有關與服務資源相關聯之條件索引鍵的詳細資訊，請參閱「資源類型」資料表的條件索引鍵欄。

動作資料表的相依動作欄會顯示成功呼叫動作所需的其他許可。除了動作本身的許可之外，還可能需要這些許可。當動作指定相依動作時，這些相依性可能適用於針對該動作定義的其他資源，而不只是資料表中列出的第一個資源。

注意

資源條件索引鍵會列在資源類型資料表中。您可以在「動作」資料表的資源類型 (*必填) 欄中找到適用於動作的資源類型連結。「資源類型」資料表中的資源類型包括條件索引鍵欄，其中包含套用至「動作」資料表中動作的資源條件索引鍵。

如需下表各欄的詳細資訊，請參閱動作資料表。

動作	描述	存取層級	資源類型 (*必填項目)	條件索引鍵	相依動作
AbortMultipartUpload	准許中止分段上傳	寫入	accesspointobject
			object
				s3:AccessGrantsInstanceArn s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
AssociateAccessGrantsIdentityCenter	准許關聯 Access Grants 身分中心	許可管理	accessgrantsinstance*
AssociateAccessGrantsIdentityCenter	准許關聯 Access Grants 身分中心	許可管理		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
BypassGovernanceRetention	准許規避控管模式物件保留設定	許可管理	accesspointobject
			object
				s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-copy-source s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-metadata-directive s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id s3:x-amz-server-side-encryption-customer-algorithm s3:x-amz-storage-class s3:x-amz-website-redirect-location
CreateAccessGrant	准許建立 Access Grants	許可管理	accessgrantslocation*
CreateAccessGrant	准許建立 Access Grants	許可管理		s3:AccessGrantScope s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey} aws:RequestTag/${TagKey} aws:TagKeys
CreateAccessGrantsInstance	准許建立 Access Grants 執行個體	許可管理	accessgrantsinstance*
CreateAccessGrantsInstance	准許建立 Access Grants 執行個體	許可管理		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateAccessGrantsLocation	准許建立 Access Grants 位置	許可管理	accessgrantsinstance*
CreateAccessGrantsLocation	准許建立 Access Grants 位置	許可管理		s3:AccessGrantsLocationScope s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey} aws:RequestTag/${TagKey} aws:TagKeys
CreateAccessPoint	准許建立新的存取點	寫入	accesspoint*
CreateAccessPoint	准許建立新的存取點	寫入		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:locationconstraint s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:AccessPointTag/${TagKey} aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateAccessPointForObjectLambda	准許建立物件 Lambda 啟用的存取點	寫入	objectlambdaaccesspoint*
CreateAccessPointForObjectLambda	准許建立物件 Lambda 啟用的存取點	寫入		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
CreateBucket	准許建立新的儲存貯體	寫入	bucket*
CreateBucket	准許建立新的儲存貯體	寫入		s3:authType s3:locationconstraint s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-object-ownership
CreateBucketMetadataTableConfiguration	准許為指定的一般用途儲存貯體建立新的 S3 中繼資料組態	寫入	bucket*		kms:DescribeKey s3tables:CreateNamespace s3tables:CreateTable s3tables:CreateTableBucket s3tables:GetTable s3tables:PutTableEncryption s3tables:PutTablePolicy
CreateBucketMetadataTableConfiguration	准許為指定的一般用途儲存貯體建立新的 S3 中繼資料組態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
CreateJob	准許建立新 Amazon S3 Batch Operations 任務	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:RequestJobPriority s3:RequestJobOperation aws:TagKeys aws:RequestTag/${TagKey}	iam:PassRole
CreateMultiRegionAccessPoint	准許建立新的多區域存取點	寫入	multiregionaccesspoint*
CreateMultiRegionAccessPoint	准許建立新的多區域存取點	寫入		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
CreateStorageLensGroup	准許建立 Amazon S3 Storage Lens 群組	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:RequestTag/${TagKey} aws:TagKeys
DeleteAccessGrant	准許刪除 Access Grant	許可管理	accessgrant*
DeleteAccessGrant	准許刪除 Access Grant	許可管理		s3:AccessGrantScope s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
DeleteAccessGrantsInstance	准許刪除 Access Grants 執行個體	許可管理	accessgrantsinstance*
DeleteAccessGrantsInstance	准許刪除 Access Grants 執行個體	許可管理		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
DeleteAccessGrantsInstanceResourcePolicy	准許讀取 Access Grants 執行個體資源政策	許可管理	accessgrantsinstance*
DeleteAccessGrantsInstanceResourcePolicy	准許讀取 Access Grants 執行個體資源政策	許可管理		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
DeleteAccessGrantsLocation	准許刪除 Access Grants 位置	許可管理	accessgrantslocation*
DeleteAccessGrantsLocation	准許刪除 Access Grants 位置	許可管理		s3:AccessGrantsLocationScope s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
DeleteAccessPoint	准許刪除 URI 中命名的存取點	寫入	accesspoint*
DeleteAccessPoint	准許刪除 URI 中命名的存取點	寫入		s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:AccessPointTag/${TagKey} aws:ResourceTag/${TagKey}
DeleteAccessPointForObjectLambda	准許刪除 URI 中命名之物件 Lambda 啟用的存取點	寫入	objectlambdaaccesspoint*
DeleteAccessPointForObjectLambda	准許刪除 URI 中命名之物件 Lambda 啟用的存取點	寫入		s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteAccessPointPolicy	准許在指定的存取點上刪除政策	許可管理	accesspoint*
DeleteAccessPointPolicy	准許在指定的存取點上刪除政策	許可管理		s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:AccessPointTag/${TagKey} aws:ResourceTag/${TagKey}
DeleteAccessPointPolicyForObjectLambda	准許刪除指定物件 Lambda 啟用之存取點上的政策	許可管理	objectlambdaaccesspoint*
DeleteAccessPointPolicyForObjectLambda	准許刪除指定物件 Lambda 啟用之存取點上的政策	許可管理		s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteBucket	准許刪除 URI 中命名的儲存貯體	寫入	bucket*
DeleteBucket	准許刪除 URI 中命名的儲存貯體	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteBucketMetadataTableConfiguration	准許刪除指定一般用途儲存貯體的 S3 中繼資料組態	寫入	bucket*
DeleteBucketMetadataTableConfiguration	准許刪除指定一般用途儲存貯體的 S3 中繼資料組態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteBucketPolicy	准許在指定的儲存貯體上刪除政策	許可管理	bucket*
DeleteBucketPolicy	准許在指定的儲存貯體上刪除政策	許可管理		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteBucketWebsite	准許移除儲存貯體的網站組態	寫入	bucket*
DeleteBucketWebsite	准許移除儲存貯體的網站組態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteJobTagging	准許從現有的 Amazon S3 Batch Operations 任務中移除標籤	標記	job*
DeleteJobTagging	准許從現有的 Amazon S3 Batch Operations 任務中移除標籤	標記		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:ExistingJobPriority s3:ExistingJobOperation
DeleteMultiRegionAccessPoint	准許刪除 URI 中指定的多區域存取點	寫入	multiregionaccesspoint*
DeleteMultiRegionAccessPoint	准許刪除 URI 中指定的多區域存取點	寫入		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
DeleteObject	准許移除物件的 null 版本，然後插入刪除標記，這會變成物件的目前版本	寫入	accesspointobject
			object
				s3:AccessGrantsInstanceArn s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:if-match
DeleteObjectTagging	准許使用 tagging 子資源，從指定的物件移除整個標籤組	標記	accesspointobject
			object
				s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteObjectVersion	准許移除特定物件版本	寫入	accesspointobject
			object
				s3:AccessGrantsInstanceArn s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
DeleteObjectVersionTagging	准許移除特定物件版本的整個標籤集	標記	accesspointobject
			object
				s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
DeleteStorageLensConfiguration	准許刪除現有 Amazon S3 Storage Lens 組態	寫入	storagelensconfiguration*
DeleteStorageLensConfiguration	准許刪除現有 Amazon S3 Storage Lens 組態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteStorageLensConfigurationTagging	准許從現有 Amazon S3 Storage Lens 組態移除標籤	標記	storagelensconfiguration*
DeleteStorageLensConfigurationTagging	准許從現有 Amazon S3 Storage Lens 組態移除標籤	標記		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DeleteStorageLensGroup	准許刪除現有的 S3 Storage Lens 群組	寫入	storagelensgroup*
DeleteStorageLensGroup	准許刪除現有的 S3 Storage Lens 群組	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DescribeJob	准許擷取批次操作任務的組態參數和狀態	讀取	job*
DescribeJob	准許擷取批次操作任務的組態參數和狀態	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
DescribeMultiRegionAccessPointOperation	准許擷取多區域存取點的組態	閱讀	multiregionaccesspointrequestarn*
DescribeMultiRegionAccessPointOperation	准許擷取多區域存取點的組態	閱讀		s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
DissociateAccessGrantsIdentityCenter	准許取消 Access Grants 身分中心關聯	許可管理	accessgrantsinstance*
DissociateAccessGrantsIdentityCenter	准許取消 Access Grants 身分中心關聯	許可管理		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetAccelerateConfiguration	准許使用 accelerate 子資源，傳回儲存貯體的 Transfer Acceleration 狀態，即已啟用或暫停	閱讀	bucket*
GetAccelerateConfiguration		閱讀		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccessGrant	准許讀取 Access Grant	閱讀	accessgrant*
GetAccessGrant	准許讀取 Access Grant	閱讀		s3:AccessGrantScope s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetAccessGrantsInstance	准許讀取 Access Grants 執行個體	閱讀	accessgrantsinstance*
GetAccessGrantsInstance	准許讀取 Access Grants 執行個體	閱讀		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetAccessGrantsInstanceForPrefix	准許依字首讀取 Access Grants 執行個體執行個體	閱讀	accessgrantsinstance*
GetAccessGrantsInstanceForPrefix	准許依字首讀取 Access Grants 執行個體執行個體	閱讀		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetAccessGrantsInstanceResourcePolicy	准許讀取 Access Grants 執行個體資源政策	閱讀	accessgrantsinstance*
GetAccessGrantsInstanceResourcePolicy	准許讀取 Access Grants 執行個體資源政策	閱讀		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetAccessGrantsLocation	准許讀取 Access Grants 位置	閱讀	accessgrantslocation*
GetAccessGrantsLocation	准許讀取 Access Grants 位置	閱讀		s3:AccessGrantsLocationScope s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetAccessPoint	准許傳回有關指定存取點的組態資訊	讀取		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:AccessPointTag/${TagKey} aws:ResourceTag/${TagKey}
GetAccessPointConfigurationForObjectLambda	准許擷取物件 Lambda 啟用之存取點的組態	讀取	objectlambdaaccesspoint*
GetAccessPointConfigurationForObjectLambda	准許擷取物件 Lambda 啟用之存取點的組態	讀取		s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccessPointForObjectLambda	准許建立物件 Lambda 啟用的存取點	閱讀	objectlambdaaccesspoint*
GetAccessPointForObjectLambda	准許建立物件 Lambda 啟用的存取點	閱讀		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccessPointPolicy	准許傳回與指定存取點相關聯的存取點政策	閱讀	accesspoint*
GetAccessPointPolicy	准許傳回與指定存取點相關聯的存取點政策	閱讀		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:AccessPointTag/${TagKey} aws:ResourceTag/${TagKey}
GetAccessPointPolicyForObjectLambda	准許傳回與指定物件 Lambda 啟用存取點相關聯的存取點政策	閱讀	objectlambdaaccesspoint*
GetAccessPointPolicyForObjectLambda	准許傳回與指定物件 Lambda 啟用存取點相關聯的存取點政策	閱讀		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccessPointPolicyStatus	准許傳回特定存取點政策的政策狀態	讀取	accesspoint*
GetAccessPointPolicyStatus	准許傳回特定存取點政策的政策狀態	讀取		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:AccessPointTag/${TagKey} aws:ResourceTag/${TagKey}
GetAccessPointPolicyStatusForObjectLambda	准許傳回特定物件 Lambda 存取點政策的政策狀態	閱讀	objectlambdaaccesspoint*
GetAccessPointPolicyStatusForObjectLambda	准許傳回特定物件 Lambda 存取點政策的政策狀態	閱讀		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAccountPublicAccessBlock	准許擷取的 PublicAccessBlock 組態 AWS 帳戶	閱讀		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetAnalyticsConfiguration	准許從 Amazon S3 儲存貯體取得分析組態 (由分析組態 ID 識別)	讀取	bucket*
GetAnalyticsConfiguration	准許從 Amazon S3 儲存貯體取得分析組態 (由分析組態 ID 識別)	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketAcl	准許使用 acl 子資源傳回 Amazon S3 儲存貯體的存取控制清單 (ACL)	讀取	accesspoint
			bucket
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketCORS	准許傳回針對 Amazon S3 儲存貯體設定的 CORS 組態資訊	讀取	accesspoint
			bucket
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketLocation	准許傳回 Amazon S3 儲存貯體所在區域	讀取	accesspoint
			bucket
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketLogging	准許傳回 Amazon S3 儲存貯體的記錄狀態，並准許使用者檢視或修改該狀態	閱讀	bucket*
GetBucketLogging	准許傳回 Amazon S3 儲存貯體的記錄狀態，並准許使用者檢視或修改該狀態	閱讀		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketMetadataTableConfiguration	准許傳回指定一般用途儲存貯體的 S3 中繼資料組態	閱讀	bucket*
GetBucketMetadataTableConfiguration	准許傳回指定一般用途儲存貯體的 S3 中繼資料組態	閱讀		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketNotification	准許取得 Amazon S3 儲存貯體的通知組態	讀取	accesspoint
			bucket
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketObjectLockConfiguration	准許取得 Amazon S3 儲存貯體的物件鎖定組態	讀取	bucket*
GetBucketObjectLockConfiguration	准許取得 Amazon S3 儲存貯體的物件鎖定組態	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:signatureversion
GetBucketOwnershipControls	授予在儲存貯體上擷取擁有權控制的許可	讀取	bucket*
GetBucketOwnershipControls	授予在儲存貯體上擷取擁有權控制的許可	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketPolicy	准許傳回指定儲存貯體的政策	讀取	accesspoint
			bucket
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketPolicyStatus	准許擷取特定 Amazon S3 儲存貯體的政策狀態，此狀態指出儲存貯體是否為公用	讀取	bucket*
GetBucketPolicyStatus	准許擷取特定 Amazon S3 儲存貯體的政策狀態，此狀態指出儲存貯體是否為公用	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketPublicAccessBlock	准許擷取 Amazon S3 儲存貯體的 PublicAccessBlock 組態	讀取	bucket*
GetBucketPublicAccessBlock	准許擷取 Amazon S3 儲存貯體的 PublicAccessBlock 組態	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketRequestPayment	准許傳回 Amazon S3 儲存貯體的請求付款組態	讀取	bucket*
GetBucketRequestPayment	准許傳回 Amazon S3 儲存貯體的請求付款組態	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketTagging	准許傳回與 Amazon S3 儲存貯體相關聯的標籤集	讀取	bucket*
GetBucketTagging	准許傳回與 Amazon S3 儲存貯體相關聯的標籤集	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketVersioning	准許傳回 Amazon S3 儲存貯體的版本控制狀態	讀取	bucket*
GetBucketVersioning	准許傳回 Amazon S3 儲存貯體的版本控制狀態	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetBucketWebsite	准許傳回 Amazon S3 儲存貯體的網站組態	閱讀	bucket*
GetBucketWebsite	准許傳回 Amazon S3 儲存貯體的網站組態	閱讀		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetDataAccess	准許取得存取權	閱讀	accessgrantsinstance*
GetDataAccess	准許取得存取權	閱讀		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
GetEncryptionConfiguration	准許傳回 Amazon S3 儲存貯體的預設加密組態	讀取	bucket*
GetEncryptionConfiguration	准許傳回 Amazon S3 儲存貯體的預設加密組態	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetIntelligentTieringConfiguration	准許取得或列出 S3 儲存貯體中的所有 Amazon S3 Intelligent Tiering 組態	讀取	bucket*
GetIntelligentTieringConfiguration	准許取得或列出 S3 儲存貯體中的所有 Amazon S3 Intelligent Tiering 組態	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetInventoryConfiguration	准許從 Amazon S3 儲存貯體傳回庫存組態 (由庫存組態 ID 識別)	讀取	bucket*
GetInventoryConfiguration	准許從 Amazon S3 儲存貯體傳回庫存組態 (由庫存組態 ID 識別)	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetJobTagging	准許傳回現有 Amazon S3 Batch Operations 任務的標籤集	讀取	job*
GetJobTagging	准許傳回現有 Amazon S3 Batch Operations 任務的標籤集	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetLifecycleConfiguration	准許傳回 Amazon S3 儲存貯體上的生命週期組態資訊集	讀取	bucket*
GetLifecycleConfiguration	准許傳回 Amazon S3 儲存貯體上的生命週期組態資訊集	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetMetricsConfiguration	准許從 Amazon S3 儲存貯體取得指標組態	閱讀	bucket*
GetMetricsConfiguration	准許從 Amazon S3 儲存貯體取得指標組態	閱讀		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetMultiRegionAccessPoint	准許傳回有關指定多區域存取點的組態資訊	閱讀	multiregionaccesspoint*
GetMultiRegionAccessPoint	准許傳回有關指定多區域存取點的組態資訊	閱讀		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
GetMultiRegionAccessPointPolicy	准許傳回與指定多區域存取點相關聯的存取點政策	閱讀	multiregionaccesspoint*
GetMultiRegionAccessPointPolicy	准許傳回與指定多區域存取點相關聯的存取點政策	閱讀		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
GetMultiRegionAccessPointPolicyStatus	准許傳回特定多區域存取點政策的政策狀態	閱讀	multiregionaccesspoint*
GetMultiRegionAccessPointPolicyStatus	准許傳回特定多區域存取點政策的政策狀態	閱讀		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
GetMultiRegionAccessPointRoutes	准許傳回多區域存取點的路由組態	閱讀	multiregionaccesspoint*
GetMultiRegionAccessPointRoutes	准許傳回多區域存取點的路由組態	閱讀		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
GetObject	准許從 Amazon S3 擷取物件	讀取	accesspointobject
			object
				s3:AccessGrantsInstanceArn s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectAcl	准許傳回物件的存取控制清單 (ACL)	閱讀	accesspointobject
			object
				s3:AccessGrantsInstanceArn s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectAttributes	准許擷取與特定物件相關聯的屬性	閱讀	accesspointobject
			object
				s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectLegalHold	准許取得物件的目前法務保存狀態	讀取	accesspointobject
			object
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectRetention	准許擷取物件的保留設定	讀取	accesspointobject
			object
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectTagging	准許傳回物件的標籤集	讀取	accesspointobject
			object
				s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectTorrent	准許從 Amazon S3 儲存貯體傳回 torrent 檔案	讀取	object*
GetObjectTorrent	准許從 Amazon S3 儲存貯體傳回 torrent 檔案	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectVersion	准許擷取特定物件版本	讀取	accesspointobject
			object
				s3:AccessGrantsInstanceArn s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
GetObjectVersionAcl	准許傳回特定物件版本的存取控制清單 (ACL)	閱讀	accesspointobject
			object
				s3:AccessGrantsInstanceArn s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
GetObjectVersionAttributes	准許擷取與特定物件版本相關的屬性	閱讀	accesspointobject
			object
				s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
GetObjectVersionForReplication	准許同時複寫未加密物件和使用 SSE-S3 或 SSE-KMS 加密的物件	讀取	object*
GetObjectVersionForReplication	准許同時複寫未加密物件和使用 SSE-S3 或 SSE-KMS 加密的物件	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetObjectVersionTagging	准許傳回特定物件版本的標籤集	讀取	accesspointobject
			object
				s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
GetObjectVersionTorrent	准許使用 versionId 子資源取得有關不同版本的 Torrent 檔案	讀取	object*
GetObjectVersionTorrent	准許使用 versionId 子資源取得有關不同版本的 Torrent 檔案	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
GetReplicationConfiguration	准許取得 Amazon S3 儲存貯體上的複寫組態資訊集	讀取	bucket*
GetReplicationConfiguration	准許取得 Amazon S3 儲存貯體上的複寫組態資訊集	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetStorageLensConfiguration	准許取得 Amazon S3 Storage Lens 組態	讀取	storagelensconfiguration*
GetStorageLensConfiguration	准許取得 Amazon S3 Storage Lens 組態	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetStorageLensConfigurationTagging	准許取得現有 Amazon S3 Storage Lens 配置標籤集	讀取	storagelensconfiguration*
GetStorageLensConfigurationTagging	准許取得現有 Amazon S3 Storage Lens 配置標籤集	讀取		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetStorageLensDashboard	准許取得 Amazon S3 Storage Lens 儀表板	閱讀	storagelensconfiguration*
GetStorageLensDashboard	准許取得 Amazon S3 Storage Lens 儀表板	閱讀		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
GetStorageLensGroup	准許取得 Amazon S3 Storage Lens 群組	閱讀	storagelensgroup*
GetStorageLensGroup	准許取得 Amazon S3 Storage Lens 群組	閱讀		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
InitiateReplication [僅限許可]	准許將物件的複寫狀態設定為待定，以啟動複寫程序	寫入	object*
InitiateReplication [僅限許可]	准許將物件的複寫狀態設定為待定，以啟動複寫程序	寫入		s3:ResourceAccount
ListAccessGrants	准許列出 Access Grant	清單	accessgrantsinstance*
ListAccessGrants	准許列出 Access Grant	清單		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
ListAccessGrantsInstances	准許列出 Access Grants 執行個體	清單		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListAccessGrantsLocations	准許列出 Access Grants 位置	清單	accessgrantsinstance*
ListAccessGrantsLocations	准許列出 Access Grants 位置	清單		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
ListAccessPoints	准許列出存取點	列出		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListAccessPointsForObjectLambda	准許列出物件 Lambda 啟用的存取點	列出		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListAllMyBuckets	准許列出已驗證的請求發送者擁有的所有儲存貯體	列出		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListBucket	准許列出 Amazon S3 儲存貯體中的部分或所有物件 (最多 1000 個)	列出	accesspoint
			bucket
				s3:AccessGrantsInstanceArn s3:authType s3:delimiter s3:max-keys s3:prefix s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListBucketMultipartUploads	准許列出進行中的分段上傳	列出	bucket*
ListBucketMultipartUploads	准許列出進行中的分段上傳	列出		s3:AccessGrantsInstanceArn s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:AccessPointTag/${TagKey} aws:ResourceTag/${TagKey}
ListBucketVersions	准許列出有關 Amazon S3 儲存貯體中所有物件版本的中繼資料	清單	accesspoint
			bucket
				s3:AccessGrantsInstanceArn s3:authType s3:delimiter s3:max-keys s3:prefix s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListCallerAccessGrants	准許列出發起人的存取授予	清單	accessgrantsinstance*
ListCallerAccessGrants	准許列出發起人的存取授予	清單		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
ListJobs	准許列出目前任務和最近結束的任務	清單		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListMultiRegionAccessPoints	准許列出多區域存取點	清單		s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
ListMultipartUploadParts	准許列出特定分段上傳已上傳的部分	列出	accesspointobject
			object
				s3:AccessGrantsInstanceArn s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListStorageLensConfigurations	准許列出 Amazon S3 Storage Lens 組態	清單		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListStorageLensGroups	准許列出 S3 Storage Lens 群組	清單		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ListTagsForResource	准許列出連接至指定資源的標籤	清單	accessgrant
			accessgrantsinstance
			accessgrantslocation
			accesspoint
			storagelensgroup
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ObjectOwnerOverrideToBucketOwner	准許變更複本所有權	許可管理	object*
ObjectOwnerOverrideToBucketOwner	准許變更複本所有權	許可管理		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PauseReplication [僅限許可]	准許暫停從目標來源儲存貯體到目的地儲存貯體的 S3 複寫	寫入	bucket*		s3:GetReplicationConfiguration s3:PutReplicationConfiguration
PauseReplication [僅限許可]	准許暫停從目標來源儲存貯體到目的地儲存貯體的 S3 複寫	寫入		s3:destinationRegion s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutAccelerateConfiguration	准許使用 accelerate 子資源，設定現有 S3 儲存貯體的 Transfer Acceleration 狀態	寫入	bucket*
PutAccelerateConfiguration	准許使用 accelerate 子資源，設定現有 S3 儲存貯體的 Transfer Acceleration 狀態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutAccessGrantsInstanceResourcePolicy	准許放置 Access grants 執行個體資源政策	許可管理	accessgrantsinstance*
PutAccessGrantsInstanceResourcePolicy	准許放置 Access grants 執行個體資源政策	許可管理		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
PutAccessPointConfigurationForObjectLambda	准許設定物件 Lambda 啟用之存取點的組態	寫入	objectlambdaaccesspoint*
PutAccessPointConfigurationForObjectLambda	准許設定物件 Lambda 啟用之存取點的組態	寫入		s3:DataAccessPointArn s3:DataAccessPointAccount s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutAccessPointPolicy	准許將存取政策與指定存取點建立關聯	許可管理	accesspoint*
PutAccessPointPolicy	准許將存取政策與指定存取點建立關聯	許可管理		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutAccessPointPolicyForObjectLambda	准許將指定物件 Lambda 啟用的存取點與存取政策建立關聯	許可管理	objectlambdaaccesspoint*
PutAccessPointPolicyForObjectLambda	准許將指定物件 Lambda 啟用的存取點與存取政策建立關聯	許可管理		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutAccessPointPublicAccessBlock	准許在建立存取點時將公開存取封鎖組態與指定的接入點建立關聯	許可管理
PutAccountPublicAccessBlock	准許建立或修改的 PublicAccessBlock 組態 AWS 帳戶	許可管理		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutAnalyticsConfiguration	准許設定儲存貯體的分析組態 (由分析組態 ID 指定)	寫入	bucket*
PutAnalyticsConfiguration	准許設定儲存貯體的分析組態 (由分析組態 ID 指定)	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketAcl	准許使用存取控制清單 (ACL) 設定現有儲存貯體的許可	許可管理	bucket*
PutBucketAcl	准許使用存取控制清單 (ACL) 設定現有儲存貯體的許可	許可管理		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp
PutBucketCORS	准許設定 Amazon S3 儲存貯體的 CORS 組態	寫入	bucket*
PutBucketCORS	准許設定 Amazon S3 儲存貯體的 CORS 組態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketLogging	准許設定 Amazon S3 儲存貯體的記錄參數	寫入	bucket*
PutBucketLogging	准許設定 Amazon S3 儲存貯體的記錄參數	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketNotification	准許在 Amazon S3 儲存貯體中發生特定事件時接收通知	寫入	bucket*
PutBucketNotification	准許在 Amazon S3 儲存貯體中發生特定事件時接收通知	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketObjectLockConfiguration	准許在特定儲存貯體上放置物件鎖定組態	寫入	bucket*
PutBucketObjectLockConfiguration	准許在特定儲存貯體上放置物件鎖定組態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:TlsVersion s3:signatureversion
PutBucketOwnershipControls	准許在儲存貯體上新增、取代或刪除擁有權控制	許可管理	bucket*
PutBucketOwnershipControls	准許在儲存貯體上新增、取代或刪除擁有權控制	許可管理		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketPolicy	准許在儲存貯體上新增或取代儲存貯體政策	許可管理	bucket*
PutBucketPolicy	准許在儲存貯體上新增或取代儲存貯體政策	許可管理		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketPublicAccessBlock	准許建立或修改特定 Amazon S3 儲存貯體的 PublicAccessBlock 組態	許可管理	bucket*
PutBucketPublicAccessBlock	准許建立或修改特定 Amazon S3 儲存貯體的 PublicAccessBlock 組態	許可管理		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketRequestPayment	准許設定儲存貯體的請求付款組態	寫入	bucket*
PutBucketRequestPayment	准許設定儲存貯體的請求付款組態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketTagging	准許將一組標籤新增至現有 Amazon S3 儲存貯體	標記	bucket*
PutBucketTagging	准許將一組標籤新增至現有 Amazon S3 儲存貯體	標記		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketVersioning	准許設定現有 Amazon S3 儲存貯體的版本控制狀態	寫入	bucket*
PutBucketVersioning	准許設定現有 Amazon S3 儲存貯體的版本控制狀態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutBucketWebsite	准許針對 website 子資源中指定的網站，設定其組態	寫入	bucket*
PutBucketWebsite	准許針對 website 子資源中指定的網站，設定其組態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutEncryptionConfiguration	准許設定 Amazon S3 儲存貯體的加密組態	寫入	bucket*
PutEncryptionConfiguration	准許設定 Amazon S3 儲存貯體的加密組態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutIntelligentTieringConfiguration	准許建立新的或更新或刪除現有 Amazon S3 Intelligent Tiering 組態	寫入	bucket*
PutIntelligentTieringConfiguration	准許建立新的或更新或刪除現有 Amazon S3 Intelligent Tiering 組態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutInventoryConfiguration	准許將庫存組態 (由庫存 ID 識別) 新增至儲存貯體	寫入	bucket*
PutInventoryConfiguration	准許將庫存組態 (由庫存 ID 識別) 新增至儲存貯體	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:InventoryAccessibleOptionalFields
PutJobTagging	准許取代現有 Amazon S3 Batch Operations 任務上的標籤	標記	job*
PutJobTagging	准許取代現有 Amazon S3 Batch Operations 任務上的標籤	標記		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:ExistingJobPriority s3:ExistingJobOperation aws:TagKeys aws:RequestTag/${TagKey}
PutLifecycleConfiguration	准許為儲存貯體建立新的生命週期組態，或取代現有的生命週期組態	寫入	bucket*
PutLifecycleConfiguration	准許為儲存貯體建立新的生命週期組態，或取代現有的生命週期組態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutMetricsConfiguration	准許為 Amazon S3 儲存貯體中的 CloudWatch 請求指標設定或更新其指標組態	Write	bucket*
PutMetricsConfiguration	准許為 Amazon S3 儲存貯體中的 CloudWatch 請求指標設定或更新其指標組態	Write		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutMultiRegionAccessPointPolicy	准許將存取政策與指定的多區域存取點建立關聯	許可管理	multiregionaccesspoint*
PutMultiRegionAccessPointPolicy	准許將存取政策與指定的多區域存取點建立關聯	許可管理		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
PutObject	准許將物件新增至儲存貯體	寫入	accesspointobject
			object
				s3:AccessGrantsInstanceArn s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-copy-source s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-metadata-directive s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id s3:x-amz-server-side-encryption-customer-algorithm s3:x-amz-storage-class s3:x-amz-website-redirect-location s3:object-lock-mode s3:object-lock-retain-until-date s3:object-lock-remaining-retention-days s3:object-lock-legal-hold s3:if-match s3:if-none-match s3:ObjectCreationOperation
PutObjectAcl	准許針對於 S3 儲存貯體中新增或現有的物件設定存取控制清單 (ACL) 許可	許可管理	accesspointobject
			object
				s3:AccessGrantsInstanceArn s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-storage-class
PutObjectLegalHold	准許將法務保存組態套用至指定物件	寫入	accesspointobject
			object
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:object-lock-legal-hold
PutObjectRetention	准許將物件保留組態放置在物件上	寫入	accesspointobject
			object
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:object-lock-mode s3:object-lock-retain-until-date s3:object-lock-remaining-retention-days
PutObjectTagging	准許將提供的標籤集設定為已存在於儲存貯體中的物件	標記	accesspointobject
			object
				s3:ExistingObjectTag/<key> s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
PutObjectVersionAcl	准許使用 acl 子資源，針對已存在於儲存貯體中的物件設定存取控制清單 (ACL)	許可管理	accesspointobject
			object
				s3:AccessGrantsInstanceArn s3:ExistingObjectTag/<key> s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-storage-class
PutObjectVersionTagging	准許針對特定物件版本設定所提供的標籤集	標記	accesspointobject
			object
				s3:ExistingObjectTag/<key> s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:versionid s3:x-amz-content-sha256
PutReplicationConfiguration	准許建立新的複寫組態或取代現有的複寫組態	寫入	bucket*		iam:PassRole
PutReplicationConfiguration	准許建立新的複寫組態或取代現有的複寫組態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:isReplicationPauseRequest
PutStorageLensConfiguration	准許建立或更新 Amazon S3 Storage Lens 組態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:TagKeys aws:RequestTag/${TagKey}
PutStorageLensConfigurationTagging	准許在現有 Amazon S3 Storage Lens 組態上放置或取代標籤	標記	storagelensconfiguration*
PutStorageLensConfigurationTagging	准許在現有 Amazon S3 Storage Lens 組態上放置或取代標籤	標記		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:TagKeys aws:RequestTag/${TagKey}
ReplicateDelete	准許將刪除標記複寫到目的地儲存貯體	寫入	object*
ReplicateDelete	准許將刪除標記複寫到目的地儲存貯體	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
ReplicateObject	准許將物件和物件標籤複寫到目的地儲存貯體	寫入	object*
ReplicateObject	准許將物件和物件標籤複寫到目的地儲存貯體	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id s3:x-amz-server-side-encryption-customer-algorithm
ReplicateTags	准許將物件標籤複寫到目的地儲存貯體	標記	object*
ReplicateTags	准許將物件標籤複寫到目的地儲存貯體	標記		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
RestoreObject	准許將物件的封存複本還原到 Amazon S3	寫入	accesspointobject
			object
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
SubmitMultiRegionAccessPointRoutes	准許提交多區域存取點的路由組態更新	寫入	multiregionaccesspoint*
SubmitMultiRegionAccessPointRoutes	准許提交多區域存取點的路由組態更新	寫入		s3:DataAccessPointAccount s3:DataAccessPointArn s3:AccessPointNetworkOrigin s3:authType s3:ResourceAccount s3:signatureversion s3:signatureAge s3:TlsVersion
TagResource	准許將標籤新增至指定資源	標記	accessgrant
			accessgrantsinstance
			accessgrantslocation
			accesspoint
			storagelensgroup
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:TagKeys aws:RequestTag/${TagKey}
UntagResource	准許從指定的資源移除標籤	標記	accessgrant
			accessgrantsinstance
			accessgrantslocation
			accesspoint
			storagelensgroup
				s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:TagKeys
UpdateAccessGrantsLocation	准許更新 Access grants 位置	許可管理	accessgrantslocation*
UpdateAccessGrantsLocation	准許更新 Access grants 位置	許可管理		s3:AccessGrantsLocationScope s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 aws:ResourceTag/${TagKey}
UpdateBucketMetadataInventoryTableConfiguration	准許更新指定一般用途儲存貯體現有 S3 中繼資料組態上的庫存資料表組態	寫入	bucket*		kms:DescribeKey s3tables:CreateNamespace s3tables:CreateTable s3tables:CreateTableBucket s3tables:GetTable s3tables:PutTableEncryption s3tables:PutTablePolicy
UpdateBucketMetadataInventoryTableConfiguration	准許更新指定一般用途儲存貯體現有 S3 中繼資料組態上的庫存資料表組態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
UpdateBucketMetadataJournalTableConfiguration	准許更新指定一般用途儲存貯體之現有 S3 中繼資料組態上的日誌資料表組態	寫入	bucket*
UpdateBucketMetadataJournalTableConfiguration	准許更新指定一般用途儲存貯體之現有 S3 中繼資料組態上的日誌資料表組態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256
UpdateJobPriority	准許更新現有任務的優先順序	寫入	job*
UpdateJobPriority	准許更新現有任務的優先順序	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:RequestJobPriority s3:ExistingJobPriority s3:ExistingJobOperation
UpdateJobStatus	准許更新指定任務的狀態	寫入	job*
UpdateJobStatus	准許更新指定任務的狀態	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256 s3:ExistingJobPriority s3:ExistingJobOperation s3:JobSuspendedCause
UpdateStorageLensGroup	准許更新現有的 S3 Storage Lens 群組	寫入	storagelensgroup*
UpdateStorageLensGroup	准許更新現有的 S3 Storage Lens 群組	寫入		s3:authType s3:ResourceAccount s3:signatureAge s3:signatureversion s3:TlsVersion s3:x-amz-content-sha256

Amazon S3 定義的資源類型

此服務會定義下列資源類型，並可用在 IAM 許可政策陳述式的 Resource 元素中。動作表格中的每個動作都代表可使用該動作指定的資源類型。資源類型也能定義您可以在政策中包含哪些條件索引鍵。這些索引鍵都會顯示在「資源類型」資料表的最後一欄。如需下表各欄的詳細資訊，請參閱資源類型資料表。

資源類型	ARN	條件索引鍵
accesspoint	`arn:${Partition}:s3:${Region}:${Account}:accesspoint/${AccessPointName}`	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn
accesspointobject	`arn:${Partition}:s3:${Region}:${Account}:accesspoint/${AccessPointName}/object/${ObjectName}`	aws:ResourceTag/${TagKey} s3:AccessPointNetworkOrigin s3:AccessPointTag/${TagKey} s3:DataAccessPointAccount s3:DataAccessPointArn
bucket	`arn:${Partition}:s3:::${BucketName}`
object	`arn:${Partition}:s3:::${BucketName}/${ObjectName}`
job	`arn:${Partition}:s3:${Region}:${Account}:job/${JobId}`	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
storagelensconfiguration	`arn:${Partition}:s3:${Region}:${Account}:storage-lens/${ConfigId}`	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
storagelensgroup	`arn:${Partition}:s3:${Region}:${Account}:storage-lens-group/${Name}`	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
objectlambdaaccesspoint	`arn:${Partition}:s3-object-lambda:${Region}:${Account}:accesspoint/${AccessPointName}`
multiregionaccesspoint	`arn:${Partition}:s3::${Account}:accesspoint/${AccessPointAlias}`
multiregionaccesspointrequestarn	`arn:${Partition}:s3:us-west-2:${Account}:async-request/mrap/${Operation}/${Token}`
accessgrantsinstance	`arn:${Partition}:s3:${Region}:${Account}:access-grants/default`	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
accessgrantslocation	`arn:${Partition}:s3:${Region}:${Account}:access-grants/default/location/${Token}`	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
accessgrant	`arn:${Partition}:s3:${Region}:${Account}:access-grants/default/grant/${Token}`	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys

Amazon S3 的條件索引鍵

Amazon S3 定義下列條件索引鍵，可用於 IAM 政策的 Condition 元素中。您可以使用這些索引鍵來縮小套用政策陳述式的條件。如需下表各欄的詳細資訊，請參閱條件索引鍵表。

若要檢視所有服務可用的全域條件索引鍵，請參閱AWS 全域條件內容索引鍵。

條件索引鍵	描述	類型
aws:RequestTag/${TagKey}	依要求中傳遞的標籤來篩選存取權	字串
aws:ResourceTag/${TagKey}	依與資源關聯的標籤來篩選存取權	字串
aws:TagKeys	依要求中傳遞的標籤索引鍵來篩選存取權	ArrayOfString
s3:AccessGrantScope	依授予的存取權範圍篩選存取權	String
s3:AccessGrantsInstanceArn	依存取權授與執行個體 ARN 篩選存取權	ARN
s3:AccessGrantsLocationScope	依存取授權位置的位置範圍篩選存取	String
s3:AccessPointNetworkOrigin	依網路來源 (網際網路或 VPC) 篩選存取權	String
s3:AccessPointTag/${TagKey}	依現有的存取點標籤索引鍵和值篩選存取權	String
s3:DataAccessPointAccount	依擁有存取點 AWS 的帳戶 ID 篩選存取權	String
s3:DataAccessPointArn	依存取點 Amazon Resource Name (ARN) 篩選存取權	ARN
s3:ExistingJobOperation	依操作篩選任務優先順序的更新存取權	字串
s3:ExistingJobPriority	依優先順序範圍篩選現有任務的取消存取權	數值
s3:ExistingObjectTag/<key>	依現有物件標籤鍵值篩選存取	String
s3:InventoryAccessibleOptionalFields	透過限制使用者在設定 S3 庫存報告時可以新增的選用中繼資料欄位來篩選存取權	ArrayOfString
s3:JobSuspendedCause	依特定任務暫停原因篩選暫停任務的取消存取權 (例如，AWAITING_CONFIRMATION)	String
s3:ObjectCreationOperation	依操作是否建立物件來篩選存取權	Bool
s3:RequestJobOperation	依操作篩選任務的建立存取權	字串
s3:RequestJobPriority	依優先順序範圍篩選新任務的建立存取權	數值
s3:RequestObjectTag/<key>	依要新增至物件的標籤鍵值篩選存取	字串
s3:RequestObjectTagKeys	依要新增至物件的標籤鍵篩選存取	ArrayOfString
s3:ResourceAccount	依資源擁有者 AWS 帳戶 ID 篩選存取權	String
s3:TlsVersion	依用戶端所使用的 TLS 版本篩選存取權	數值
s3:authType	依身分驗證方法篩選存取	字串
s3:delimiter	依分隔符號參數篩選存取	String
s3:destinationRegion	針對 AWS FIS 動作 aws：s3：bucket-pause-replication 的目標儲存貯體，依特定複寫目的地區域篩選存取權	String
s3:if-match	依請求的「If-Match」條件式標頭篩選存取權	String
s3:if-none-match	依請求的「If-None-Match」條件式標頭篩選存取權	String
s3:isReplicationPauseRequest	依透過 AWS FIS 動作 aws：s3：bucket-pause-replication 提出的請求篩選存取權	Bool
s3:locationconstraint	依特定區域篩選存取權	字串
s3:max-keys	依 ListBucket 請求傳回的最大金鑰數篩選存取權	數值
s3:object-lock-legal-hold	依物件合法保留狀態篩選存取權	字串
s3:object-lock-mode	依物件保留模式 (符合性或控管) 篩選存取權	字串
s3:object-lock-remaining-retention-days	依剩餘的物件保留天數篩選存取權	數值
s3:object-lock-retain-until-date	依物件保留至日期篩選存取權	日期
s3:prefix	依金鑰名稱字首篩選存取權	字串
s3:signatureAge	依請求簽章的存在時間篩選存取權 (以毫秒為單位)	數值
s3:signatureversion	依請求上使用的 AWS Signature 版本篩選存取權	String
s3:versionid	依特定物件版本篩選存取權	字串
s3:x-amz-acl	依請求的 x-amz-acl 標頭中的固定 ACL 篩選存取權	字串
s3:x-amz-content-sha256	篩選對儲存貯體中未簽署內容的存取	字串
s3:x-amz-copy-source	依複製來源儲存貯體、字首或複製來源請求中的物件來篩選存取權	字串
s3:x-amz-grant-full-control	依 x-amz-grant-full-control (完全控制) 標題篩選存取權	字串
s3:x-amz-grant-read	依 x-amz-grant-read (讀取權限) 標題篩選存取權	字串
s3:x-amz-grant-read-acp	依 x-amz-grant-read-acp (ACL 讀取權限) 標題篩選存取權	字串
s3:x-amz-grant-write	依 x-amz-grant-write (寫入權限) 標題篩選存取權	字串
s3:x-amz-grant-write-acp	依 x-amz-grant-write-acp (ACL 寫入權限) 標題篩選存取權	字串
s3:x-amz-metadata-directive	複製物件時，依物件中繼資料行為 (COPY 或 REPLACE) 篩選存取權	字串
s3:x-amz-object-ownership	依物件擁有權篩選存取權	字串
s3:x-amz-server-side-encryption	依伺服器端加密篩選存取權	String
s3:x-amz-server-side-encryption-aws-kms-key-id	依 AWS KMS 客戶受管 CMK 篩選存取以進行伺服器端加密	ARN
s3:x-amz-server-side-encryption-customer-algorithm	依客戶指定的演算法篩選存取權，以進行伺服器端加密	String
s3:x-amz-storage-class	依儲存類別篩選存取權	字串
s3:x-amz-website-redirect-location	針對設定為靜態網站的儲存貯體，依其特定網站重新導向位置篩選存取權	String

您的瀏覽器已停用或無法使用 Javascript。

您必須啟用 Javascript，才能使用 AWS 文件。請參閱您的瀏覽器說明頁以取得說明。

文件慣用形式

Amazon Route 53 Resolver

Amazon S3 Express