:doc:`S3Control <../../s3control>` / Client / get_bucket_policy

*****************
get_bucket_policy
*****************



.. py:method:: S3Control.Client.get_bucket_policy(**kwargs)

  

  .. note::

    

    This action gets a bucket policy for an Amazon S3 on Outposts bucket. To get a policy for an S3 bucket, see `GetBucketPolicy <https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketPolicy.html>`__ in the *Amazon S3 API Reference*.

    

   

  Returns the policy of a specified Outposts bucket. For more information, see `Using Amazon S3 on Outposts <https://docs.aws.amazon.com/AmazonS3/latest/userguide/S3onOutposts.html>`__ in the *Amazon S3 User Guide*.

   

  If you are using an identity other than the root user of the Amazon Web Services account that owns the bucket, the calling identity must have the ``GetBucketPolicy`` permissions on the specified bucket and belong to the bucket owner's account in order to use this action.

   

  Only users from Outposts bucket owner account with the right permissions can perform actions on an Outposts bucket. If you don't have ``s3-outposts:GetBucketPolicy`` permissions or you're not using an identity that belongs to the bucket owner's account, Amazon S3 returns a ``403 Access Denied`` error.

   

  .. warning::

     

    As a security precaution, the root user of the Amazon Web Services account that owns a bucket can always use this action, even if the policy explicitly denies the root user the ability to perform this action.

     

   

  For more information about bucket policies, see `Using Bucket Policies and User Policies <https://docs.aws.amazon.com/AmazonS3/latest/dev/using-iam-policies.html>`__.

   

  All Amazon S3 on Outposts REST API requests for this action require an additional parameter of ``x-amz-outpost-id`` to be passed with the request. In addition, you must use an S3 on Outposts endpoint hostname prefix instead of ``s3-control``. For an example of the request syntax for Amazon S3 on Outposts that uses the S3 on Outposts endpoint hostname prefix and the ``x-amz-outpost-id`` derived by using the access point ARN, see the `Examples <https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetBucketPolicy.html#API_control_GetBucketPolicy_Examples>`__ section.

   

  The following actions are related to ``GetBucketPolicy``:

   

  
  * `GetObject <https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html>`__
   
  * `PutBucketPolicy <https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutBucketPolicy.html>`__
   
  * `DeleteBucketPolicy <https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteBucketPolicy.html>`__
  

  

  See also: `AWS API Documentation <https://docs.aws.amazon.com/goto/WebAPI/s3control-2018-08-20/GetBucketPolicy>`_  


  **Request Syntax**
  ::

    response = client.get_bucket_policy(
        AccountId='string',
        Bucket='string'
    )
    
  :type AccountId: string
  :param AccountId: **[REQUIRED]** 

    The Amazon Web Services account ID of the Outposts bucket.

    

  
  :type Bucket: string
  :param Bucket: **[REQUIRED]** 

    Specifies the bucket.

     

    For using this parameter with Amazon S3 on Outposts with the REST API, you must specify the name and the x-amz-outpost-id as well.

     

    For using this parameter with S3 on Outposts with the Amazon Web Services SDK and CLI, you must specify the ARN of the bucket accessed in the format ``arn:aws:s3-outposts:<Region>:<account-id>:outpost/<outpost-id>/bucket/<my-bucket-name>``. For example, to access the bucket ``reports`` through Outpost ``my-outpost`` owned by account ``123456789012`` in Region ``us-west-2``, use the URL encoding of ``arn:aws:s3-outposts:us-west-2:123456789012:outpost/my-outpost/bucket/reports``. The value must be URL encoded.

    

  
  
  :rtype: dict
  :returns: 
    
    **Response Syntax**

    
    ::

      {
          'Policy': 'string'
      }
      
    **Response Structure**

    

    - *(dict) --* 
      

      - **Policy** *(string) --* 

        The policy of the Outposts bucket.

        
  