Datasource Policy Examples

S3 policy examples for configuring Datasources in Roboflow.

Use these examples when you need policy JSON for an AWS S3-backed bucket.

For the full AWS credential setup flow, including when to use Assume Role versus IAM access keys, see AWS S3 Credentials.

Custom IAM Policy

Use this policy if you want to create IAM credentials that only grant Roboflow access to one bucket.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket", "s3:GetBucketLocation"],
      "Resource": "arn:aws:s3:::your-bucket-name"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:GetObjectVersion", "s3:GetObjectTagging"],
      "Resource": "arn:aws:s3:::your-bucket-name/*"
    }
  ]
}

Replace your-bucket-name with your actual bucket name.

Bucket Policy

Use this policy if you want to grant Roboflow's AWS role direct read access to your bucket.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RoboflowBucketAccess",
      "Effect": "Allow",
      "Principal": {
        "AWS": "<roboflow-role-arn>"
      },
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:GetObject",
        "s3:GetObjectVersion",
        "s3:GetObjectTagging"
      ],
      "Resource": [
        "arn:aws:s3:::your-bucket-name",
        "arn:aws:s3:::your-bucket-name/*"
      ]
    }
  ]
}

Replace your-bucket-name with your actual bucket name and <roboflow-role-arn> with the ARN provided by your Roboflow representative.

Assume Role Trust Policy

Use this trust policy on an IAM Role in your account that Roboflow assumes to read your bucket. Attach the Custom IAM Policy above to the same role to grant the bucket read access.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "<roboflow-principal-arn>"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<your-external-id>"
        }
      }
    }
  ]
}

Replace <roboflow-principal-arn> with the principal ARN provided in the AWS console after creating a new role, and <your-external-id> with the External ID displayed when creating the Credential in Roboflow.