FEATURES / Bucket Policy Viewer
/// Bucket Policy Viewer
Understand your bucket policies without parsing JSON.
View S3 bucket policies with color-coded risk annotations. Public grants, wildcard actions, and cross-account access flagged automatically — without you reading every line of JSON.
Start for freePolicy JSON, annotated. Risks flagged. Nothing buried.
/// How it works
Select any bucket
Pick a bucket from any connected AWS account. Storafleet fetches and displays the current bucket policy immediately — no Console navigation.
Review with risk annotations
The policy is displayed as annotated JSON. Each statement is flagged: safe, caution (cross-account), or danger (wildcard/public). Risk summary shown in the sidebar.
Identify and act on risks
Click any annotation to understand what it means. Copy the policy JSON to edit it in your IaC tool, or flag it for your team's security review queue.
Full policy JSON in one view
See the raw bucket policy for any connected bucket immediately. No navigating through Console tabs — open any bucket and the policy is right there.
Risk annotations
Storafleet color-codes every statement in the policy: green for clearly safe grants, amber for cross-account or condition-gated access, red for wildcard or public grants.
Wildcard detection
s3:* in an Action, * in a Principal — Storafleet flags these prominently. Wildcard policies are the most common source of unintended S3 access.
Public grant highlighting
Any statement with Principal: * is flagged as a public read or write grant. Intentional CDN use or accidental misconfiguration — you'll see it immediately.
Cross-account access visibility
Statements that grant access to external AWS account IDs are highlighted separately. Know which cross-account grants are intentional and which need review.
View across all buckets
Browse policies for any bucket across all connected AWS accounts. No account switching in the Console — select any bucket from the list and see its policy.
/// Without Storafleet
Reading an S3 bucket policy means parsing JSON manually to understand what each statement actually grants.
- Bucket policies are raw JSON — requires reading every Principal, Action, and Condition manually
- Wildcard Actions (s3:*) and public Principals (*) look identical to safe grants without close reading
- No cross-bucket policy view — must click into each bucket individually in the Console
- No way to instantly see if a bucket has cross-account access without reading the entire policy
- Policy review for compliance audits requires documenting each bucket manually
/// With Storafleet
Annotated policy viewer. Public, wildcard, and cross-account grants color-coded. No JSON reading required.
- Full policy JSON displayed immediately for any bucket across all connected accounts
- Risk annotations: green (safe), amber (cross-account or conditional), red (wildcard/public)
- Wildcard Actions and public Principals flagged prominently in the annotation sidebar
- Cross-account grants highlighted separately with the external account ID shown
- Copy raw JSON directly from the viewer for editing in Terraform or CloudFormation
/// When you'll use this
Reviewing a policy before a SOC 2 audit
The auditor asks for a summary of all S3 bucket policies that grant cross-account access. You open Storafleet, check each bucket's policy, and the cross-account grants are already highlighted in amber. Producing the answer takes minutes — not hours of JSON parsing.
Key featureAnnotated policy viewer with cross-account grant highlighting
Debugging unexpected access denied
An application is hitting access denied on a bucket it should be able to read. You pull up the bucket policy in Storafleet — there's a Deny statement with a condition that's blocking the app's IAM role. You spot it in the annotated view in under a minute.
Key featurePolicy viewer for access debugging
Verifying no buckets have unintended public write access
You've just set up S3 for a new product. Before launch, you want to confirm no bucket accidentally has a public write grant. Storafleet scans all policies and shows you a clean view — no public grants flagged. Ship with confidence.
Key featurePublic grant audit across all bucket policies
Your storage estate deserves a control plane.
Join the DevOps teams and founders who run every cloud's buckets from one control plane.
Free plan · No credit card · 50+ cloud providers · Cancel any time