Revision history [back]

To set a deny policy on PutObject for only files that already exist in an S3 bucket, you can use a bucket policy with a condition that checks for object existence using the key name. Here's an example policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyPutForExistingObjects",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::bucket-name/*",
            "Condition": {
                "StringEqualsIfExists": {
                    "s3:ExistingObjectTag/Key": "true"
                }
            }
        }
    ]
}

This policy denies the PutObject action if the object already exists in the bucket by checking the value of the s3:ExistingObjectTag/Key tag. If the tag exists and its value is "true", the PutObject action is denied.

To apply this policy, you can use the AWS Management Console, the AWS CLI, or the SDKs. Make sure to replace "bucket-name" with the name of your S3 bucket.