---
title: "AWS Restricting Access To Specific folder In S3"
slug: "aws-restricting-access-to-specific-folder-in-s3"
updated: 2026-10-13T12:20:13Z
published: 2026-10-13T12:20:13Z
canonical: "docs.dataloop.ai/aws-restricting-access-to-specific-folder-in-s3"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dataloop.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# S3 Restricted Folder Access

## Use case

In a case you want to **restrict** the **access** of DDOE to **specific folder** within your S3 bucket, you can easily do that. You can grant DDOE access to only the specific folder you want DDOE to work with, without worrying about accidental modifications or deletions in other parts of your S3 bucket.

In this article, we'll walk you through the steps to limits DDOE's access to a specific folder in your S3 bucket.

Restrict via AWS IAM policy & DDOE Storage Driver

You'll need to create a **specific IAM policy** and **specific Storage driver**, so when creating an integration follow this article IAM policy and storage driver creation

---

## Create any type of integration

For example - [AWS Cross Account integration](https://docs.dataloop.ai/docs/aws-cross-account-integration).

---

## Create an IAM policy

1. Log in to the [AWS Management Console](https://aws.amazon.com/console/).
2. Go to **Services** and click **All services**. A list of services is displayed.
3. Select the **IAM** service from the list.
4. Click on **Policies** from the left navigation panel.
5. Click **Create policy**. The Create Policy page is displayed.
6. Select the JSON tab.
7. Define the policy document in JSON format as follows:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowBucketListAccessWithPrefix",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<DataLoopBucketName>"
            ],
            "Condition": {
                "StringEquals": {
                    "s3:prefix": "<DataLoopFolderName>/"
                }
            }
        },
        {
            "Sid": "AllowBucketGetPutDelete",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::<DataLoopBucketName>/<DataLoopFolderName>/*"
            ]
        }
    ]
}
```

1. Click **Next** to Review the policy.
2. Provide a meaningful name for the policy and an optional description.
3. Click the **Create policy** to finish.

Note:

a. `s3:DeleteObject` action allows DDOE platform to delete dataset items - please see [downstream](https://docs.dataloop.ai/docs/sync-cloud-storage-drivers#downstream) a. Replace `&lt;DataLoopBucketName&gt;` with the name of the desired S3 bucket. c. Replace `&lt;DataLoopFolderName&gt;` with the name of the desired folder you would like to restrict the access to.

- Read step-by-step guide on creating an [IAM policy in AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html).
- Read step-by-step guide on [condition key examples in AWS](https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html).