---
# generated by https://github.com/hashicorp/terraform-plugin-docs
page_title: "orcasecurity_integration_s3_bucket_policy Data Source - orcasecurity"
subcategory: ""
description: |-
  Render the bucket policy that must be attached to an S3 bucket BEFORE creating an orcasecurity_integration_s3_bucket resource.
---

# orcasecurity_integration_s3_bucket_policy (Data Source)

Renders the bucket policy that Orca's S3 uploader role needs in order to write
into the target bucket.

Use this data source whenever you need the bucket policy independently of the
resource — for example when the bucket policy is managed in a different
Terraform workspace, applied manually through the AWS console, or rolled out
via a separate change-management process.

You **must** apply the policy to the bucket before creating an
[`orcasecurity_integration_s3_bucket`](../resources/integration_s3_bucket.md)
resource: Orca's create call runs a connectivity check that writes a test
object, and without the policy in place the create fails with
`No permission to write to bucket.`

## Standalone usage (recommended when the bucket policy is managed elsewhere)

```terraform
data "orcasecurity_integration_s3_bucket_policy" "orca" {
  arn_or_url = "arn:aws:s3:::my-bucket"
  folder     = "folder_value"
}

output "orca_bucket_policy" {
  value = data.orcasecurity_integration_s3_bucket_policy.orca.bucket_policy_json
}

output "orca_bucket_policy_instructions" {
  value = data.orcasecurity_integration_s3_bucket_policy.orca.bucket_policy_instructions
}
```

`terraform apply` prints the rendered policy. Hand it to whoever owns the
bucket (or run `aws s3api put-bucket-policy --bucket my-bucket --policy
file://policy.json` yourself). Only after the policy is attached do you create
the `orcasecurity_integration_s3_bucket` resource — in this workspace, in a
different one, or never.

## Example Usage

```terraform
# Render the bucket policy Orca needs before creating an S3 bucket integration.
data "orcasecurity_integration_s3_bucket_policy" "orca" {
  arn_or_url = "arn:aws:s3:::my-bucket"
  folder     = "folder_value"
}

output "policy_instructions" {
  value = data.orcasecurity_integration_s3_bucket_policy.orca.bucket_policy_instructions
}

output "policy_json" {
  value = data.orcasecurity_integration_s3_bucket_policy.orca.bucket_policy_json
}
```

## Argument Reference

* `arn_or_url` — (Required, String) S3 bucket reference. Must start with
  `arn:`, `https://`, `http://`, or `s3://`. The rendered policy always uses
  the bucket-name-only ARN form (`arn:<partition>:s3:::<bucket>/...`).
  The partition comes from the Orca tenant (`GET /api/settings`), not from
  this value.
* `folder` — (Optional, String) Sub-folder inside the bucket. Leave unset for
  the bucket root.

## Attribute Reference

* `bucket_name` — (String) Bucket name parsed from `arn_or_url`.
* `uploader_role_arn` — (String) Orca's S3 uploader role ARN (`Principal.AWS`
  in the rendered policy). Fetched from `GET /api/settings`.
* `bucket_policy_json` — (String) Bucket policy document ready to feed into
  `aws_s3_bucket_policy.policy`.
* `bucket_policy_instructions` — (String) `"Add this policy to the bucket permissions."`.