Is it necessary to specify resource in S3 Bucket Policies?

Question

Is it necessary to specify a resource attribute within the statements that make up an S3 bucket policy? The Access Policy Language Overview seems to suggest that the resource attribute is always included, though it doesn't come straight out and say it's required. Consider this example policy shown on the language overview page.

{
  "Version": "2012-10-17",
  "Id": "ExamplePolicy01",
  "Statement": [
    {
      "Sid": "ExampleStatement01",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::Account-ID:user/Dave"
      },
      "Action": [
        "s3:GetObject",
        "s3:GetBucketLocation",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::examplebucket/*",
        "arn:aws:s3:::examplebucket"
      ]
    }
  ]
}

A bucket policy is assigned to an S3 bucket, so it seems like the policy would always be evaluated in the context of the bucket that it's assigned to. Based on that, it seems like it should be possible to omit the resource attribute.

If the resource attribute really is required, is it possible to use a wildcard arn like this? Would that carry any risks, or would it simply allow access to the bucket exactly as if the bucket was named in the policy?

      "Resource": [
        "arn:aws:s3:::*",
        "arn:aws:s3:::*/*"
      ]

(For greater clarity, I am NOT talking about IAM policies in this question.)

Answer 1

Yes, Resource is a required element on S3 bucket policies. If the resource is omitted, the API will respond with an error resembling this one below.

status code: 400
Error putting S3 policy: MalformedPolicy: Statement is missing required element

The reasoning is that each statement could apply to the bucket itself, the contents of the bucket, or some subset of the bucket contents, and it's up to the user to clarify. In theory AWS could provide a default that includes both the bucket and all of its contents, but that design probably wasn't chosen because it makes it too easy to accidentally make the bucket policies broader than expected.

Additionally, it is not permissible to use a wildcard in the resource element of an S3 bucket policy. Attempts to do so will yield an error such as this:

Error putting S3 policy: MalformedPolicy: Policy has invalid resource