Skip to main content
This lesson shows how to use S3 Access Points to provide scoped, manageable access to a shared S3 bucket. The demo uses a bucket named kk-access-point containing a single object, beach.jpg. We’ll create two access points — developers and finance — and delegate control from the bucket to those access points so each team can access the bucket through its own endpoint and policy.
A screenshot of the Amazon Web Services S3 "Create bucket" console showing the General configuration panel with a bucket name field and AWS Region selector. The page also displays object ownership/ACL options and block public access settings.
Prerequisites:
  • An S3 bucket (kk-access-point) with a test object beach.jpg.
  • Three IAM users in the same account: user1 (bucket owner / creator), user2, and user3.
  • AWS CLI or CloudShell for testing. See links at the end for docs.
Initial state
  • As the bucket owner (user1) you can access beach.jpg.
  • Other users in the same account (user2 and user3) have no access initially; attempts result in 403 Forbidden.
Example object identifiers:
Testing access from CloudShell / AWS CLI (example of denied access for an unauthorized user):
Goal
  • Provide scoped access for user2 and user3 without maintaining many per-user bucket policies.
  • Use S3 Access Points: each team accesses the same bucket via a different access point endpoint and policy.
Create access points
  • Create two access points for the bucket: developers and finance.
  • Access points can be restricted to a VPC or be internet-accessible. For this demo they are internet-accessible.
Screenshot of the AWS S3 web console on the "kk-access-point" bucket's Access Points tab. It shows two access points named "developers" and "finance" with buttons to create/copy/edit access points.
Delegate bucket control to access points Important: access point policies only take effect if the bucket accepts access-point-routed requests. There are two options:
  • Copy access point policies into the bucket policy (cumbersome and error-prone).
  • Recommended: add a bucket policy that delegates acceptance of access point requests that originate from access points owned by the bucket owner’s account.
Example bucket policy that delegates access control to access points owned by account 123456789012. Replace with your account ID and bucket name:
Add this policy to the bucket’s Permissions → Bucket policy. This instructs the bucket to accept requests that are routed through access points owned by the specified account, letting the access point policies enforce the actual permissions. Access point ARNs and object ARNs Access point ARNs differ from bucket ARNs. When specifying object-level resources in policies you must include the /object/ segment after the access point name.
  • Access point ARN (bucket-level actions, e.g., list): arn:aws:s3:us-east-1:123456789012:accesspoint/developers
  • Access point object ARN (object-level actions, e.g., get/put): arn:aws:s3:us-east-1:123456789012:accesspoint/developers/object/*
Always include the /object/ segment in an access point ARN when specifying object-level resources in policies (for example: ...:accesspoint/<name>/object/<prefix>/*). Forgetting /object/ is a common cause of permission errors.
Access point policy examples Developers access point — grant user2 list, get, and put via the developers access point. Update region, account ID, access point name, and principal as appropriate:
Notes on these policies:
  • Use the /object/* resource for object-level actions like s3:GetObject and s3:PutObject.
  • Use the access point resource without /object/ for bucket-level actions like s3:ListBucket.
  • Resource-based policies cannot reference IAM groups as principals. To grant a group of users access, use an IAM role (and let users assume it) or attach identity-based policies to the users.
Test via AWS CLI When using the AWS CLI with access points, use an S3 URI that starts with s3://arn:aws:s3:...:accesspoint/<name>. Examples (replace the ARN components with your region/account/access point):
Important: include the s3:// prefix; omitting it or passing a bare ARN will be rejected by the CLI. Repeat for finance access point Create an access point policy for finance and grant user3 equivalent (or different) permissions via the finance access point. Example finance access point policy:
Example CLI actions for user3:
Access point block public access settings Access points can have their own Block Public Access settings. Verify the access point’s block settings when configuring public/internet access.
Screenshot of the AWS S3 console showing "Block Public Access settings for this Access Point" with several block options turned On. Below is an Access Point policy panel indicating public access is blocked, with Edit and Delete buttons.
After configuration
  • user2 accesses the bucket using the developers access point ARN and the developers policy applies.
  • user3 accesses the bucket using the finance access point ARN and the finance policy applies.
  • The bucket policy delegates acceptance of access-point-routed requests to access points owned by the bucket owner’s account (via s3:DataAccessPointAccount).
Quick reference — ARNs and usage Troubleshooting tips
  • If you see 403 Forbidden when using an access point:
    • Confirm the bucket policy includes the s3:DataAccessPointAccount condition allowing access point requests from the account.
    • Ensure access point policies include both the access point ARN and the access point object ARN for the required actions.
    • Verify you used the s3:// scheme for CLI calls to access point URIs.
    • Double-check the /object/ segment in any object-level ARN.
Summary
  • S3 Access Points let you provide per-team scoped access to a shared bucket endpoint, simplifying permission management.
  • Delegate acceptance of access-point-routed requests in the bucket policy using s3:DataAccessPointAccount.
  • Include both the access point ARN and the access point object ARN (with /object/) when defining access point policies to allow list and object actions.
Links and references

Watch Video

Practice Lab