Is it possible to limit RestoreObject policy by data access tier?

Question

Is it possible to create a policy such that it limits the `s3:RestoreObject` action only to a particular restore tier?

**Example:**

Can we have a policy that only allows "Bulk" restores, but it does not allow "Standard" nor "Expedited" restores.

I imagine if there is a way, it would have to do with the `Condition` element
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Allow only Bulk Restore",
            "Effect": "Allow",
            "Action": "s3:RestoreObject",
            "Resource": "arn:aws:s3:::mybucket/*",
            "Condition": {
                ?
            }
        }
    ]
}
```

Answer

Hi,

You may want to try the condition key [s3:x-amz-storage-class](https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html#sc-howtoset:~:text=Restricting%20access%20policy%20permissions%20to%20a%20specific%20storage%20class) which filters access by storage class. Take a look at this reference [Actions, resources, and condition keys for Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/list_amazons3.html) with the whole list.

When you grant access policy permissions for Amazon S3 operations, you can use the [s3:x-amz-storage-class](https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html#sc-howtoset:~:text=Restricting%20access%20policy%20permissions%20to%20a%20specific%20storage%20class) condition key to restrict which storage class to use when storing uploaded objects. For example, when you grant the s3:PutObject permission, you can restrict object uploads to a specific storage class. For an example policy, see [Example 5: Restricting object uploads to objects with a specific storage class](https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html#example-storage-class-condition-key:~:text=%2D%2Dprofile%20AccountADave-,Example%205%3A%20Restricting%20object%20uploads%20to%20objects%20with%20a%20specific%20storage%20class,-Suppose%20that%20Account)

I hope this helps!!!

Is it possible to limit RestoreObject policy by data access tier?

Relevant content