Understanding which policy attaches to an Amazon S3 Glacier vault and how it controls access

Learn how a resource-based vault access policy governs access to an Amazon S3 Glacier vault. This policy sets who can access the vault and what actions they can perform, at the vault level, with notable distinctions from other policy types in AWS security.

When you think about securing data in the cloud, you want a guard that sits right where the data lives. For Amazon S3 Glacier, that guard is the vault access policy. A vault policy is a resource-based permission document attached directly to a Glacier vault. It doesn’t live in IAM users or roles alone; it lives with the vault itself, defining who can do what with that vault. If you’re exploring Glacier security, understanding vault access policies is a natural starting point.

The essentials: what a vault access policy does

Think of a vault access policy as a compact set of rules that say who is allowed to interact with a specific vault and which actions they’re permitted to perform. This is different from the more general IAM policies that associate permissions with users, groups, or roles. A vault policy gives you vault-scoped control, letting you grant or constrain access at the vault level. It’s especially handy in multi-tenant scenarios, data governance contexts, or when you want to pin down cross-account access without broadening IAM permissions across the board.

Two quick mental models help here:

• Resource-based control: The policy lives with the vault and governs access to that vault. It’s your vault’s own access passport.

• Principal- and action-focused: The policy spells out which principals (users, roles, or even other AWS accounts) can perform specific Glacier actions on that vault.

Why this matters in the real world

Security isn’t just about keeping the door closed; it’s about controlling who can do what if the door opens. A vault access policy provides a precise, auditable way to manage data access. You can:

• Permit another AWS account to retrieve jobs against a vault without granting broad permissions to that account’s IAM users.

• Limit access to only certain actions, such as initiating a retrieval job or checking vault details.

• Enforce least privilege by granting only the minimum necessary actions for the vault’s operational needs.

It’s also worth noting what doesn’t apply here. Instance metadata policies, while important for EC2 instances, aren’t designed to govern Glacier vault access. Likewise, broad network access control policies (which are great for network boundaries) don’t badge access at the vault level. And user access policies, while crucial, live in IAM and apply to users or roles rather than tying permissions directly to a vault. The vault policy is the glue that binds access decisions to the vault itself.

Where you attach the policy and what it looks like

You attach a vault access policy directly to a Glacier vault. You can set this policy through the AWS Management Console, AWS CLI, or the Glacier API. The process is straightforward, but a careful touch matters. A well-crafted policy keeps access explicit and traceable.

A simple example helps illustrate the idea. Suppose you want to allow a specific AWS account to initiate retrieval jobs and to describe the vault, but you don’t want to grant broader access. Here’s what a minimal vault access policy might resemble in JSON:

{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Principal": { "AWS": "arn:aws:iam::123456789012:root" },

"Action": [

"glacier:InitiateJob",

"glacier:GetJobOutput",

"glacier:DescribeVault",

"glacier:ListVaults"

],

"Resource": "arn:aws:glacier:us-west-2:123456789012:vaults/example-vault"

}

]

}

A few notes on the policy:

• Version and the Statement array are the standard boilerplate you’ll see in most AWS policy documents.

• Principal identifies who can access. In a cross-account scenario, you point to the other account’s root user or a specific IAM role or user within that account.

• Action lists the Glacier operations you permit. You’ll typically include the actions that the intended workflow requires.

• Resource ties the policy to a particular vault. You’ll see an ARN that looks like arn:aws:glacier:region:account-id:vaults/vault-name.

How to apply it: a quick, practical walkthrough

If you’re using the AWS Console:

• Open the Glacier service in the region where your vault lives.

• Select the vault you want to protect.

• Find the section for access policies (often labeled something like Vault access policy or similar).

• Paste or upload your policy JSON, then save.

If you’re using the AWS CLI:

• Prepare policy.json with the policy you want.

• Run a command along the lines of:

aws glacier set-vault-access-policy --account-id - --vault-name example-vault --policy file://policy.json

Note: account-id - means the master account in the CLI context; you can also specify a numeric account ID if you’re targeting a different account’s vault.

If you’re using an API or IaC tool:

• In the Glacier API, you’ll call SetVaultAccessPolicy with the vault name and your policy document.

• In IaC (like CloudFormation or Terraform), you’ll represent the policy as a JSON or YAML string and attach it to the vault resource, depending on the provider’s Glacier support.

What to watch for as you design policies

• Principle of least privilege: grant only the actions that are actually needed for the vault’s intended workflow. It’s tempting to be broad, but a tighter policy pays off in the long run.

• Cross-account considerations: if you’re enabling access from another AWS account, document and monitor who belongs to that account. Cross-account access is powerful but requires clear governance.

• Auditability: keep policy versions, and consider annotating policies with comments (where supported) or maintaining a change log. It helps during audits and in day-to-day security reviews.

• Testing access: after applying a policy, test access carefully. Confirm that the allowed operations work as intended and that disallowed actions are indeed blocked.

• Regional implications: Glacier vault ARNs include the region. Make sure you reference the correct region in the policy to avoid silent access issues.

• Compatibility with lifecycle and retrieval workflows: ensure that the permitted actions align with how your data is stored, archived, and retrieved. If a retrieval job is part of the operations, include the relevant InitiateJob and GetJobOutput actions.

A few digressions you might find handy

While we’re on the subject, it’s interesting to note how Glacier’s access model fits into the broader cloud security landscape. In many teams, vault-level policies serve as a precise, auditable boundary while IAM policies cover broader access across services. It’s not about one right tool and the other wrong one; it’s about layered defense. Vault policies reduce blast radii. If a user’s IAM permissions get too broad for a moment, the vault policy can still throttle what that user or account can actually do with that vault.

If you’ve ever worked with data governance, you know the thrill of having a clear, enforceable boundary. You can tell at a glance who can do what with a vault, when, and under what conditions. And because Glacier is designed for long-term archival, this kind of governance isn’t just nice to have—it’s essential for compliance-minded workflows, too.

Common questions that often pop up in practice

• Can I attach multiple vault policies to a single vault? Yes. Glacier allows you to define policies that reflect the needs of different stakeholders, as long as the combined policy remains coherent and doesn’t grant contradictory permissions.

• How do I revoke access? Remove the relevant statements or replace the policy with a new version that limits or removes the previously granted permissions. Always verify the policy you intend to apply.

• Do vault policies override IAM policies? Vault policies operate at the vault level and complement IAM policies. In effect, a user needs both the IAM permissions to access the Glacier service and the vault policy permissions to act on a specific vault.

Embracing a thoughtful security posture

Security isn’t a one-and-done task. It’s a habit—regular reviews, updates to reflect changing teams, and a quick check after any organizational change. Vault access policies are a crisp, auditable line of defense that sits at the edge of your data’s home. They pair nicely with monitoring, logging, and alerting to keep you in the loop about who’s accessing what, when, and how.

If you’re building a security-minded workflow around Glacier, start with a solid vault access policy. Map out who needs access, for which actions, and why. Then attach the policy to the vault and monitor access patterns over time. It’s not a glamorous feature, but it’s the kind of robust, practical control that keeps data safer without getting in the way of legitimate work.

To wrap it up, the type of policy you attach to a Glacier vault is called a resource-based vault access policy. It lives with the vault and shapes who can perform specific Glacier operations on that vault. By centering access control at the vault level, you gain precise governance while keeping the broader ecosystem—IAM users and roles—still in play for other parts of your cloud environment. In the end, thoughtful vault policies are a steady, reliable companion in the journey of secure, well-governed data storage.