Policy: AWS > S3 > Bucket > Policy > Trusted Access > Organization Path Restrictions
List of AWS Organization Paths that are trusted for cross-account access in the AWS S3 bucket policy, or '*' to skip the Organization Path Restriction.
Note that Trusted Access > Accounts and Trusted Access > Organization Paths are evaluated independently. To have access, an AWS principal must be allowed in Trusted Access > Accounts AND be a member of the Organization Path that is allowed in Trusted Access > Organization Paths.
Note: Trusted Access > Organization Path Restrictions are ONLY applied to AWS principals. Services and Federated principals do NOT contain the aws:PrincipalOrgPaths condition key, and thus cannot be validated against the Organization Path. Also, please note that this policy will validate organization paths against ForAnyValue:StringLike conditional operator for a given bucket policy condition.example: - "o-333333333/r-wxnb/ou-wxnb-dasdtpaq/ou-*" - "o-444444444/r-wxnb/ou-wxnb-dfadtpaq/*"
Resource Types
This policy targets the following resource types:
Primary Policy
This policy is used with the following primary policy:
Controls
Policy Packs
This policy setting is used by the following policy packs:
Policy Specification
Schema Type | |
|---|---|
Default | |
Category
In Your Workspace
Developers
- tmod:@turbot/turbot#/control/categories/securityTrustedAccess
- tmod:@turbot/aws-s3#/policy/types/bucketPolicyTrustedOrganizationPaths
- turbot graphql policy-type --id "tmod:@turbot/aws-s3#/policy/types/bucketPolicyTrustedOrganizationPaths"
- turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/aws-s3#/policy/types/bucketPolicyTrustedOrganizationPaths"
Get Policy TypeGet Policy Settings