---
type: resource-type
title: S3BucketPolicy
description: aws resource type AWS::S3::BucketPolicy
name: S3BucketPolicy
lexicon: aws
resource_type: AWS::S3::BucketPolicy
---
`AWS::S3::BucketPolicy`, a resource type of the aws lexicon.

## Properties

- `Bucket` (`string`, required): The name of the Amazon S3 bucket to which the policy applies.
- `PolicyDocument` (`PolicyDocument`, required): A policy document containing permissions to add to the specified bucket. In IAM, you must provide policy documents in JSON format. However, in CloudFormation you can provide the policy in JSON or YAML format because CloudFormation converts YAML to JSON before submitting it to IAM. For more information, see the AWS::IAM::Policy [PolicyDocument](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html#cfn-iam-policy-policydocument) resource description in this guide and [Access Policy Language Overview](https://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html) in the *Amazon S3 User Guide*.

## Governed by

- [WAW042](/rules/WAW042.md): S3 bucket missing a TLS-only bucket policy — deny requests over plaintext