AWS AmazonS3 documentation change

Service: AmazonS3 · 2025-08-19 · Documentation low

File: AmazonS3/latest/userguide/batch-ops-iam-role-policies.md

Summary

Added IAM policy requirements for Compute checksum operations, including permissions for GetObject, GetObjectVersion, RestoreObject, and PutObject.

Security assessment

Documents permissions required for checksum operations (a data integrity feature), but does not address a specific security vulnerability. Focuses on enabling security-related functionality.

Diff

diff --git a/AmazonS3/latest/userguide/batch-ops-iam-role-policies.md b/AmazonS3/latest/userguide/batch-ops-iam-role-policies.md
index 5b2b9d5b8..744d6a9d4 100644
--- a//AmazonS3/latest/userguide/batch-ops-iam-role-policies.md
+++ b//AmazonS3/latest/userguide/batch-ops-iam-role-policies.md
@@ -511,0 +512,42 @@ JSON
+### **Compute checksum** : Allow `GetObject`, `GetObjectVersion`, `RestoreObject`, and `PutObject`
+
+Use this policy if you're trying to use the **Compute checksum** operation with S3 Batch Operations. Permissions for `GetObject`, `GetObjectVersion`, and `RestoreObject` are required to obtain and read the bytes of stored data. Replace the user input placeholders with your own information. For more information about **Compute checksum** , see [Checking object integrity for data at rest in Amazon S3](./checking-object-integrity-at-rest.html).
+    
+    
+    {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:GetObject",
+            "s3:GetObjectVersion",
+            "s3:RestoreObject"
+          ],
+          "Resource": [
+            "arn:aws:s3:::amzn-s3-demo-bucket1/*"
+          ]
+        },
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:GetObject",
+            "s3:GetObjectVersion"
+          ],
+          "Resource": [
+            "arn:aws:s3:::amzn-s3-demo-bucket2/*"
+          ]
+        },
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:PutObject"
+          ],
+          "Resource": [
+            "arn:aws:s3:::amzn-s3-demo-bucket3/*"
+          ]
+        }
+      ]
+    }
+    
+