GetBucketPolicy

GetBucketPolicy returns the policy document attached to a bucket. On STRG buckets do not carry policies, so there is never a document to return: the operation checks that the bucket exists and answers 404 NoSuchBucketPolicy - the same answer Amazon S3 gives for a bucket that has never had a policy. Tools that read the policy while describing a bucket already treat NoSuchBucketPolicy as "no policy", so they work unchanged.

Who can reach a bucket is decided by the permissions and bucket scope of each access key, together with the bucket's Bucket Protection setting in the dashboard. That keeps everything about access in two places you can see at a glance, rather than in a JSON document.

Good to know on STRG

Buckets have no policies, so the answer is always 404 NoSuchBucketPolicy, never a policy document.
PutBucketPolicy, DeleteBucketPolicy and GetBucketPolicyStatus are answered with 501 NotImplemented, so a client knows straight away.
x-amz-expected-bucket-owner is welcome and has nothing to check: a key only ever reaches buckets of its own account.

When you'd use it

Tools that describe a bucket. Infrastructure-as-code tools, backup utilities and inventory scripts written for Amazon S3 read a bucket's policy along with its other settings. On STRG they get the familiar "no policy" answer and carry on describing the bucket.
Security and compliance checks. A script that audits buckets for policies granting public access finds none here. Whether a bucket is readable without credentials is its Bucket Protection setting, which Anonymous reads describes.

Request

GET /?policy HTTP/1.1
Host: my-bucket.s3.eu-central-1.strg.com
Authorization: AWS4-HMAC-SHA256 Credential=...
x-amz-date: 20260926T120000Z
x-amz-content-sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

The path-style form is GET /my-bucket?policy on s3.eu-central-1.strg.com - Addressing explains both.

Permissions

The access key needs Read bucket settings (buckets:read-config). Every access key holds it, whether it covers all buckets or only some - a key scoped to specific buckets reads only those. Access keys has the details.

URI parameters

Name	Type	Required	Description
`Bucket`	String	Yes	The bucket whose policy to read.
`policy`	Flag	Yes	Selects this operation. Sent with no value.

Any other query parameter is answered with 501 NotImplemented, so a client knows straight away that it has no effect here.

Request headers

Name	Type	Required	Description
`x-amz-expected-bucket-owner`	String	No	Welcome, with nothing to check: an access key only ever reaches its own account's buckets.

Request body

None.

Response

For a bucket that exists, the answer is always the 404 NoSuchBucketPolicy error below. A 200 OK with a policy document is never sent.

Response headers

Name	Description
`Content-Type`	`application/xml` - the error document.
`x-amz-request-id`	The request ID, handy for a support request.

Response body

Element	Type	Description
`Policy`	String (JSON)	Never sent. On Amazon S3, a successful answer's body is the bucket policy as a JSON document.

This is what STRG sends instead, for a path-style request - Resource is the request path:

<?xml version="1.0" encoding="UTF-8"?>
<Error>
  <Code>NoSuchBucketPolicy</Code>
  <Message>The bucket policy does not exist</Message>
  <Resource>/my-bucket</Resource>
  <BucketName>my-bucket</BucketName>
  <RequestId>...</RequestId>
</Error>

Errors

These are the errors this request can return, and the situation behind each one.

Code	HTTP status	When
`NoSuchBucketPolicy`	404	Always, for a bucket that exists and that the access key can reach.
`NoSuchBucket`	404	The bucket does not exist, belongs to another account, is in a region other than the endpoint's, or the account stores nothing in the endpoint's region yet.
`AccessDenied`	403	The access key is scoped to buckets that do not include this one, the account is not active, or the request is unsigned.
`InvalidAccessKeyId`	403	The access key does not exist, has expired or been revoked - or it was created moments ago and is not usable yet in a region where the account already stores data, in which case the same request works shortly afterwards.
`SignatureDoesNotMatch`	403	The request signature does not match.
`RequestTimeTooSkewed`	403	The request time is more than 15 minutes from the server's.
`AuthorizationHeaderMalformed`	400	The signature's credential scope names a region other than the endpoint's.
`NotImplemented`	501	The request carries a query parameter this operation does not accept.
`SlowDown`	503	Too many requests. The `Retry-After` header says when a retry is welcome; the AWS SDKs retry on their own.
`ServiceUnavailable`	503	A temporary failure; the same request can be retried.
`InternalError`	500	An unexpected failure while checking the bucket; the same request can be retried.

Differences from Amazon S3

The table lists each place where STRG behaves differently, and what that means for a client.

Aspect	Amazon S3	STRG
Bucket policies	A JSON policy document per bucket	Buckets have no policies. The answer is always `404 NoSuchBucketPolicy`
Controlling access	Bucket policies, IAM and ACLs	Access key permissions and bucket scope, plus Bucket Protection in the dashboard. Access keys has the details
Setting or removing a policy	PutBucketPolicy, DeleteBucketPolicy	Answered with `501 NotImplemented`
Bucket in another region	`301` redirect with `x-amz-bucket-region`	`404 NoSuchBucket`. A bucket is reached through its own regional endpoint.
`x-amz-expected-bucket-owner`	Checked against the bucket owner	Welcome, with nothing to check

Examples

Every client reports NoSuchBucketPolicy as an error, and each example below treats it as "this bucket has no policy".

AWS CLI
Python (boto3)
JavaScript (AWS SDK v3)

aws s3api get-bucket-policy \
  --bucket my-bucket \
  --endpoint-url https://s3.eu-central-1.strg.com \
  --region eu-central-1

The command ends with An error occurred (NoSuchBucketPolicy) when calling the GetBucketPolicy operation: The bucket policy does not exist and a non-zero exit status.

import boto3
from botocore.exceptions import ClientError

s3 = boto3.client(
    "s3",
    endpoint_url="https://s3.eu-central-1.strg.com",
    region_name="eu-central-1",
)

try:
    response = s3.get_bucket_policy(Bucket="my-bucket")
    print(response["Policy"])
except ClientError as error:
    if error.response["Error"]["Code"] == "NoSuchBucketPolicy":
        print("no bucket policy")
    else:
        raise

import { GetBucketPolicyCommand, S3Client } from "@aws-sdk/client-s3";

const client = new S3Client({
  endpoint: "https://s3.eu-central-1.strg.com",
  region: "eu-central-1",
});

try {
  const response = await client.send(new GetBucketPolicyCommand({ Bucket: "my-bucket" }));
  console.log(response.Policy);
} catch (error) {
  if (error.name === "NoSuchBucketPolicy") {
    console.log("no bucket policy");
  } else {
    throw error;
  }
}

GetBucketAcl
PutBucketAcl
GetPublicAccessBlock
Access keys
S3 API overview - including the other S3 operations

View as Markdown

When you'd use it​

Request​

Permissions​

URI parameters​

Request headers​

Request body​

Response​

Response headers​

Response body​

Errors​

Differences from Amazon S3​

Examples​

Related​