> For the complete documentation index, see [llms.txt](https://docs.roboflow.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.roboflow.com/datasets/adding-data/datasources/datasource-policy-examples.md).

# Datasource Policy Examples

Use these examples when you need policy JSON for an AWS S3-backed bucket.

For the full AWS credential setup flow, including when to use Assume Role versus IAM access keys, see [AWS S3 Credentials](/datasets/adding-data/datasources/datasource-credentials/aws-s3.md).

## Custom IAM Policy

Use this policy if you want to create IAM credentials that only grant Roboflow access to one bucket.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket", "s3:GetBucketLocation"],
      "Resource": "arn:aws:s3:::your-bucket-name"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:GetObjectVersion", "s3:GetObjectTagging"],
      "Resource": "arn:aws:s3:::your-bucket-name/*"
    }
  ]
}
```

Replace `your-bucket-name` with your actual bucket name.

## Bucket Policy

Use this policy if you want to grant Roboflow's AWS role direct read access to your bucket.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RoboflowBucketAccess",
      "Effect": "Allow",
      "Principal": {
        "AWS": "<roboflow-role-arn>"
      },
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:GetObject",
        "s3:GetObjectVersion",
        "s3:GetObjectTagging"
      ],
      "Resource": [
        "arn:aws:s3:::your-bucket-name",
        "arn:aws:s3:::your-bucket-name/*"
      ]
    }
  ]
}
```

Replace `your-bucket-name` with your actual bucket name and `<roboflow-role-arn>` with the ARN provided by your Roboflow representative.

## Assume Role Trust Policy

Use this trust policy on an IAM Role in your account that Roboflow assumes to read your bucket. Attach the [Custom IAM Policy](#custom-iam-policy) above to the same role to grant the bucket read access.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "<roboflow-principal-arn>"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<your-external-id>"
        }
      }
    }
  ]
}
```

Replace `<roboflow-principal-arn>` with the principal ARN provided in the AWS console after creating a new role, and `<your-external-id>` with the External ID displayed when creating the Credential in Roboflow.