GetBucketPolicy
  • 05 Nov 2026
  • Dark
    Light

GetBucketPolicy

  • Dark
    Light

Article summary

Get
/{bucket}

Availability

Early Access: July 1, 2026

Early Access is gated; contact the Backblaze Sales team for access.

Limited Availability: July 1, 2026

This API is available only to customers with access to the Backblaze Enterprise Web Console. For more information, contact the Backblaze Sales team.

Return the current bucket policy

Endpoint: GET /{bucket}/?policy on s3.{region}.backblazeb2.com.

Example request

 GET /analytics-bucket/?policy HTTP/1.1 Host: s3.us-west-002.backblazeb2.com 

Example response

 HTTP/1.1 200 x-amz-request-id: req-1234567890 x-amz-id-2: abcdefghijklmnopqrstuvwxyz1234567890abcdef
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:role/analytics-role"},"Action":["s3:GetObject"],"Resource":["arn:aws:s3:::analytics-bucket/*"]}]} 

Errors

  • NoSuchBucket
  • AccessDenied
Security
API Key: sigv4
Header parameter nameAuthorization

AWS Signature Version 4. The Authorization header takes the form AWS4-HMAC-SHA256 Credential=..., SignedHeaders=..., Signature=.... For IAM and STS requests, the signing region is not validated; use any non-empty region value consistently. The signing service must be iam for IAM requests and sts for STS requests. When using temporary credentials, also include X-Amz-Security-Token: <session-token>.

Path parameters
bucket
stringRequired

The name of the bucket. Provided in the request path.

Exampleanalytics-bucket
Query parameters
policy
stringRequired

Subresource indicator. Must be present as ?policy (no value).

Example
Responses
200

The current bucket policy as JSON.

"{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",...}]}"
string
403
HTTP StatusCodeDescription
403AccessDeniedThe authenticated principal lacks permission.
404
HTTP StatusCodeDescription
404NoSuchBucketBucket not found.
404NoSuchBucketPolicyThe bucket has no policy configured.

Was this article helpful?