aws_s3_bucket_policy cost estimation

An aws_s3_bucket_policy attaches a JSON resource policy to a bucket that grants or denies access to principals and actions. The policy itself is free: AWS does not charge for attaching, storing, or evaluating a bucket policy, no matter how many statements it contains. Cost sits on the bucket it protects: stored bytes per GB-month, request charges, and egress on downloads.

A policy is worth understanding for cost because it decides which requests reach the bucket, and requests and transfer are billed. A policy that allows public reads or grants access to another account opens paths for GET traffic and egress you then pay for. Denying unencrypted uploads or requiring TLS costs nothing but shapes what the bucket does. A policy that permits cross-account or internet access is a signal to check the request volume and egress that access will drive.

There is no meter on the policy to optimize. The useful move is to read a bucket policy as a map of who can generate billable requests and transfer against your data. c3x prices the aws_s3_bucket, its stored objects, requests, and egress, and treats the policy as the free access-control document it is.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_s3_bucket_policy" "assets" {
  bucket = aws_s3_bucket.assets.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Sid       = "DenyInsecureTransport"
      Effect    = "Deny"
      Principal = "*"
      Action    = "s3:*"
      Resource = [
        aws_s3_bucket.assets.arn,
        "${aws_s3_bucket.assets.arn}/*"
      ]
      Condition = {
        Bool = { "aws:SecureTransport" = "false" }
      }
    }]
  })
}

Pricing dimensions

What you actually pay for when you provision aws_s3_bucket_policy.

Dimension	Unit	What's being charged
Bucket policy	free	Attaching, storing, and evaluating a bucket policy has no charge regardless of statement count. $0
Requests it permits	per 1,000 requests	GET, PUT, and LIST traffic the policy allows is billed on the bucket, not the policy. GET: $0.0004/1,000
Egress on allowed reads	per GB	Data transfer out to the internet when the policy permits public or cross-account downloads. First 10 TB: ~$0.09/GB

Optimization tips

Common ways to reduce aws_s3_bucket_policy cost without changing the workload.

Read the policy as a cost map

A statement that grants public or cross-account read access opens billable GET traffic and egress. Confirm that access is intended and check the request volume it will drive.

Deny unencrypted or insecure access cheaply

Conditions that require TLS or block unencrypted uploads add no cost and prevent misconfigured access paths that can generate surprise request and transfer charges.

Prefer VPC endpoint access for internal reads

Removes internet egress on internal traffic

If a policy grants access to internal services, scoping it to a VPC endpoint keeps that traffic off internet egress and reduces transfer cost on heavy reads.

FAQ

Does an S3 bucket policy cost money?

No. Attaching and evaluating a bucket policy is free no matter how many statements it has. You pay only for the bucket: storage per GB-month, requests, and egress on the traffic the policy permits.

How does a bucket policy affect my S3 bill?

Indirectly. The policy decides which requests reach the bucket, and requests and egress are billed. A policy allowing public or cross-account reads opens paths for GET traffic and data transfer you then pay for.