PutBucketPolicy

Availability

Early Access: July 1, 2026

Early Access is gated; contact the Backblaze Sales team for access.

Limited Availability: July 1, 2026

This API is available only to customers with access to the Backblaze Enterprise Web Console. For more information, contact the Backblaze Sales team.

Add or replace a bucket policy

Endpoint: PUT /{bucket}/?policy on s3.{region}.backblazeb2.com. Bucket policy APIs work the same as AWS and are served through the S3 API. Requests must be made to the specific region containing the bucket.

Example request

 PUT /analytics-bucket/?policy HTTP/1.1 Host: s3.us-west-002.backblazeb2.com Content-Type: application/json Content-Length: 198
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:role/analytics-role"},"Action":["s3:GetObject"],"Resource":["arn:aws:s3:::analytics-bucket/*"]}]} 

Example response

 HTTP/1.1 204 No Content x-amz-request-id: req-1234567890 x-amz-id-2: abcdefghijklmnopqrstuvwxyz1234567890abcdef 

Example: Bucket policy restricting access to approved corporate IP ranges

 {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCorporateNetworkOnly",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::123456789012:user/reporting-user" },
      "Action": ["s3:GetObject","s3:PutObject"],
      "Resource": ["arn:aws:s3:::analytics-bucket/*"],
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": ["203.0.113.0/24","2001:db8:1234::/48"]
        }
      }
    }
  ]
} 

Example: Bucket policy granting read-only access to a role

 {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAnalyticsRead",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::123456789012:role/analytics-role" },
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::analytics-bucket/*"]
    }
  ]
} 

Errors

• MalformedPolicy
• AccessDenied
• NoSuchBucket