| s3:AssociateAccessGrantsIdentityCenter | Admin |
| s3:BypassGovernanceRetention | Admin |
| s3:CreateAccessGrant | Admin |
| s3:CreateAccessGrantsInstance | Admin |
| s3:CreateAccessGrantsLocation | Admin |
| s3:CreateAccessPoint | Admin |
| s3:CreateAccessPointForObjectLambda | Admin |
| s3:CreateBucketMetadataTableConfiguration | Admin |
| s3:CreateMultiRegionAccessPoint | Admin |
| s3:CreateStorageLensGroup | Admin |
| s3:DeleteAccessGrant | Admin |
| s3:DeleteAccessGrantsInstance | Admin |
| s3:DeleteAccessGrantsInstanceResourcePolicy | Admin |
| s3:DeleteAccessGrantsLocation | Admin |
| s3:DeleteAccessPoint | Admin |
| s3:DeleteAccessPointForObjectLambda | Admin |
| s3:DeleteAccessPointPolicy | Admin |
| s3:DeleteAccessPointPolicyForObjectLambda | Admin |
| s3:DeleteAccountPublicAccessBlock | Admin |
| s3:DeleteBucketCors | Admin |
| s3:DeleteBucketEncryption | Admin |
| s3:DeleteBucketIntelligentTieringConfiguration | Admin |
| s3:DeleteBucketMetadataTableConfiguration | Admin |
| s3:DeleteBucketLifecycle | Admin |
| s3:DeleteBucketLifecycleConfiguration | Admin |
| s3:DeleteBucketOwnershipControls | Admin |
| s3:DeleteBucketPolicy | Admin |
| s3:DeleteBucketReplication | Admin |
| s3:DeleteBucketWebsite | Admin |
| s3:DeleteJobTagging | Admin |
| s3:DeleteMultiRegionAccessPoint | Admin |
| s3:DeletePublicAccessBlock | Admin |
| s3:DeleteStorageLensConfiguration | Admin |
| s3:DeleteStorageLensConfigurationTagging | Admin |
| s3:DeleteStorageLensGroup | Admin |
| s3:DissociateAccessGrantsIdentityCenter | Admin |
| s3:ObjectOwnerOverrideToBucketOwner | Admin |
| s3:PutAccelerateConfiguration | Admin |
| s3:PutAccessGrantsInstanceResourcePolicy | Admin |
| s3:PutAccessPointConfigurationForObjectLambda | Admin |
| s3:PutAccessPointPolicy | Admin |
| s3:PutAccessPointPolicyForObjectLambda | Admin |
| s3:PutAccessPointPublicAccessBlock | Admin |
| s3:PutAccountPublicAccessBlock | Admin |
| s3:PutAnalyticsConfiguration | Admin |
| s3:PutBucketAbac | Admin |
| s3:PutBucketEncryption | Admin |
| s3:PutBucketIntelligentTieringConfiguration | Admin |
| s3:PutBucketObjectLockConfiguration | Admin |
| s3:PutBucketOwnershipControls | Admin |
| s3:PutBucketPolicy | Admin |
| s3:PutBucketPublicAccessBlock | Admin |
| s3:PutBucketWebsite | Admin |
| s3:PutEncryptionConfiguration | Admin |
| s3:PutIntelligentTieringConfiguration | Admin |
| s3:PutInventoryConfiguration | Admin |
| s3:PutJobTagging | Admin |
| s3:PutLifecycleConfiguration | Admin |
| s3:PutMetricsConfiguration | Admin |
| s3:PutMultiRegionAccessPointPolicy | Admin |
| s3:PutObjectLegalHold | Admin |
| s3:PutObjectLockConfiguration | Admin |
| s3:PutPublicAccessBlock | Admin |
| s3:PutStorageLensConfiguration | Admin |
| s3:PutStorageLensConfigurationTagging | Admin |
| s3:SubmitMultiRegionAccessPointRoutes | Admin |
| s3:UpdateAccessGrantsLocation | Admin |
| s3:UpdateBucketMetadataInventoryTableConfiguration | Admin |
| s3:UpdateBucketMetadataJournalTableConfiguration | Admin |
| s3:UpdateStorageLensGroup | Admin |
| s3:WriteGetObjectResponse | Admin |
| s3:AbortMultipartUpload | Operator |
| s3:CreateBucket | Operator |
| s3:CreateJob | Operator |
| s3:DeleteBucket | Operator |
| s3:DeleteBucketTagging | Operator |
| s3:DeleteObject | Operator |
| s3:DeleteObjectVersion | Operator |
| s3:DeleteObjectVersionTagging | Operator |
| s3:PutBucketNotification | Operator |
| s3:PutBucketTagging | Operator |
| s3:PutBucketVersioning | Operator |
| s3:PutObject | Operator |
| s3:PutObjectRetention | Operator |
| s3:PutObjectTagging | Operator |
| s3:PutObjectVersionTagging | Operator |
| s3:RestoreObject | Operator |
| s3:TagResource | Operator |
| s3:UntagResource | Operator |
| s3:UpdateJobPriority | Operator |
| s3:UpdateJobStatus | Operator |
| s3:GetObject | ReadOnly |
| s3:GetObjectTorrent | ReadOnly |
| s3:GetObjectVersion | ReadOnly |
| s3:GetObjectVersionForReplication | ReadOnly |
| s3:GetObjectVersionTorrent | ReadOnly |
| s3:HeadObject | ReadOnly |
| s3:SelectObjectContent | ReadOnly |
| s3:DescribeJob | Metadata |
| s3:DescribeMultiRegionAccessPointOperation | Metadata |
| s3:GetAccelerateConfiguration | Metadata |
| s3:GetAccessGrant | Metadata |
| s3:GetAccessGrantsInstance | Metadata |
| s3:GetAccessGrantsInstanceForPrefix | Metadata |
| s3:GetAccessGrantsInstanceResourcePolicy | Metadata |
| s3:GetAccessGrantsLocation | Metadata |
| s3:GetAccessPoint | Metadata |
| s3:GetAccessPointConfigurationForObjectLambda | Metadata |
| s3:GetAccessPointForObjectLambda | Metadata |
| s3:GetAccessPointPolicy | Metadata |
| s3:GetAccessPointPolicyForObjectLambda | Metadata |
| s3:GetAccessPointPolicyStatus | Metadata |
| s3:GetAccessPointPolicyStatusForObjectLambda | Metadata |
| s3:GetAccountPublicAccessBlock | Metadata |
| s3:GetAnalyticsConfiguration | Metadata |
| s3:GetBucket | Metadata |
| s3:GetBucketAbac | Metadata |
| s3:GetBucketAccelerateConfiguration | Metadata |
| s3:GetBucketAcl | Metadata |
| s3:GetBucketCORS | Metadata |
| s3:GetBucketEncryption | Metadata |
| s3:GetBucketIntelligentTieringConfiguration | Metadata |
| s3:GetBucketLifecycleConfiguration | Metadata |
| s3:GetBucketMetadataTableConfiguration | Metadata |
| s3:GetBucketLocation | Metadata |
| s3:GetBucketLogging | Metadata |
| s3:GetBucketNotification | Metadata |
| s3:GetBucketNotificationConfiguration | Metadata |
| s3:GetBucketObjectLockConfiguration | Metadata |
| s3:GetBucketOwnershipControls | Metadata |
| s3:GetBucketPolicy | Metadata |
| s3:GetBucketPolicyStatus | Metadata |
| s3:GetBucketPublicAccessBlock | Metadata |
| s3:GetBucketReplication | Metadata |
| s3:GetBucketRequestPayment | Metadata |
| s3:GetBucketTagging | Metadata |
| s3:GetBucketVersioning | Metadata |
| s3:GetBucketWebsite | Metadata |
| s3:GetDataAccess | Metadata |
| s3:GetEncryptionConfiguration | Metadata |
| s3:GetIntelligentTieringConfiguration | Metadata |
| s3:GetInventoryConfiguration | Metadata |
| s3:GetJobTagging | Metadata |
| s3:GetLifecycleConfiguration | Metadata |
| s3:GetMetricsConfiguration | Metadata |
| s3:GetMultiRegionAccessPoint | Metadata |
| s3:GetMultiRegionAccessPointPolicy | Metadata |
| s3:GetMultiRegionAccessPointPolicyStatus | Metadata |
| s3:GetMultiRegionAccessPointRoutes | Metadata |
| s3:GetObjectAcl | Metadata |
| s3:GetObjectAttributes | Metadata |
| s3:GetObjectLegalHold | Metadata |
| s3:GetObjectLockConfiguration | Metadata |
| s3:GetObjectRetention | Metadata |
| s3:GetObjectTagging | Metadata |
| s3:GetObjectVersionAcl | Metadata |
| s3:GetObjectVersionAttributes | Metadata |
| s3:GetObjectVersionTagging | Metadata |
| s3:GetPublicAccessBlock | Metadata |
| s3:GetReplicationConfiguration | Metadata |
| s3:GetStorageLensConfiguration | Metadata |
| s3:GetStorageLensConfigurationTagging | Metadata |
| s3:GetStorageLensDashboard | Metadata |
| s3:GetStorageLensGroup | Metadata |
| s3:HeadBucket | Metadata |
| s3:ListAccessGrants | Metadata |
| s3:ListAccessGrantsInstances | Metadata |
| s3:ListAccessGrantsLocations | Metadata |
| s3:ListAccessPoints | Metadata |
| s3:ListAccessPointsForObjectLambda | Metadata |
| s3:ListAllMyBuckets | Metadata |
| s3:ListBucket | Metadata |
| s3:ListBucketByTags | Metadata |
| s3:ListBucketIntelligentTieringConfigurations | Metadata |
| s3:ListCallerAccessGrants | Metadata |
| s3:ListBucketMultipartUploads | Metadata |
| s3:ListBuckets | Metadata |
| s3:ListBucketVersions | Metadata |
| s3:ListJobs | Metadata |
| s3:ListMultipartUploadParts | Metadata |
| s3:ListMultiRegionAccessPoints | Metadata |
| s3:ListRegionalBuckets | Metadata |
| s3:ListStorageLensConfigurations | Metadata |
| s3:ListStorageLensGroups | Metadata |
| s3:ListTagsForResource | Metadata |
