Amazon S3 now supports attribute-based access control

This article announces that Amazon S3 now supports attribute-based access control (ABAC) for general purpose buckets, enabling tag-based permission management.

• ABAC automatically evaluates tag-based conditions in IAM policies before granting access
• Eliminates frequent IAM and bucket policy updates as organizations grow
• Grant access by adding or modifying tags on buckets instead of updating policies
• Enable ABAC using S3 PutBucketAbac API and manage tags via TagResource/UntagResource APIs
• Require specific tags at bucket creation to enforce consistent tagging standards
• Available in all AWS Regions at no additional cost
• Accessible via AWS Management Console, S3 REST API, AWS CLI, SDK, and CloudFormation

S3 ABAC simplifies access governance at scale by leveraging bucket tags for automatic permission management.