Skip to Content
We are live but in Staging 🎉
Data EnginesObjectsCLI Guidedodil data bucket policy

dodil data bucket policy

S3-style ACL on a bucket — set, get, delete. Mirrors Policy — API Reference. See Core Concepts → Policy for the BucketPolicy type signature.

dodil data bucket policy set

dodil data bucket policy set [name] -f FILE
dodil data bucket policy set [name] -f -        # read from stdin

Reads a JSON document (file or stdin) and applies it as the bucket’s policy via SetBucketPolicy. Setting a policy also flips the bucket’s access_mode to BUCKET_ACCESS_MODE_CUSTOM — no separate bucket update needed.

FlagShortTypeDefaultDescription
--file-fstring-JSON file path, or - for stdin

The CLI takes the proto shape only. It parses your file with protojson and sends it over gRPC, so the AWS spellings the HTTP door tolerates — Statement, Effect: "Allow", Principal: {"AWS": "*"}, ARNs in Resource — will either fail to parse or be stored verbatim and never match. Write version + statements, camelCase fields, POLICY_EFFECT_ALLOW / POLICY_EFFECT_DENY, and bare key globs in resources. If you have an AWS document to port, PUT it to /admin/buckets/:name/policy over HTTP instead.

What the server will accept: exactly five actions (s3:GetObject, s3:PutObject, s3:DeleteObject, s3:ListBucket, s3:HeadObject — s3:* is rejected), principals of "*" / "authenticated" / "org:<org_id>", and resources as object-key globs (*, ?). Full rules in Policy — API Reference.

Example — from a file:

cat > policy.json <<'EOF'
{
  "version": "2024-01-01",
  "statements": [
    {
      "sid": "allow-public-read",
      "effect": "POLICY_EFFECT_ALLOW",
      "principal": { "aws": ["*"] },
      "actions": ["s3:GetObject"],
      "resources": ["public/*"]
    }
  ]
}
EOF
 
dodil data bucket policy set kb-prod -f policy.json

Or via stdin (handy in pipelines):

jq '.' policy.json | dodil data bucket policy set kb-prod -f -

dodil data bucket policy get

dodil data bucket policy get [name]

Returns the current BucketPolicy. Use -o json for the canonical pbjson form (suitable for editing and piping back into policy set -f -). A bucket with no policy errors with NotFound: no policy set on this bucket — it does not print an empty document.

Example — fetch, edit, push back:

dodil data bucket policy get kb-prod -o json > current.json
# ...edit current.json...
dodil data bucket policy set kb-prod -f current.json

dodil data bucket policy delete

dodil data bucket policy delete [name]

Removes the policy from the bucket and forces access_mode back to BUCKET_ACCESS_MODE_PRIVATE — it does not restore whatever mode the bucket had before. If the bucket was meant to stay public, follow up with dodil data bucket update <name> --access-mode public.

Example:

dodil data bucket policy delete kb-prod

See also

dodil data bucketdodil data bucket cors