s3:GetBucketLogging

Read

s3:GetBucketLogging is a Read access-level action in the s3 service. Grants permission to return the logging status of an Amazon S3 bucket and the permissions users have to view or modify that status

Resource types

ARNs that s3:GetBucketLogging can be scoped to in an IAM policy.

arn:${Partition}:s3:::${BucketName}
bucket

Condition keys

Keys you can use in the Condition block of a policy that grants s3:GetBucketLogging.

aws:ResourceTag/${TagKey} String

Filters access by the tags associated with the resource

s3:BucketTag/${TagKey} String

Filters access by the tags associated with the bucket

Example IAM policy

A minimal policy that allows s3:GetBucketLogging. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3GetBucketLogging",
      "Effect": "Allow",
      "Action": "s3:GetBucketLogging",
      "Resource": "*"
    }
  ]
}

Related actions in s3

s3:AbortMultipartUpload Write s3:AllowVendedLogDeliveryForResource Read s3:AssociateAccessGrantsIdentityCenter Permissions management s3:BypassGovernanceRetention Permissions management s3:CreateAccessGrant Permissions management s3:CreateAccessGrantsInstance Permissions management s3:CreateAccessGrantsLocation Permissions management s3:CreateAccessPoint Write s3:CreateAccessPointForObjectLambda Write s3:CreateBucket Write s3:CreateBucketMetadataTableConfiguration Write s3:CreateJob Write

View all s3 actions →