title: How do I modify a Bucket Policy to allow Root Credentials/IAM user
body: <p>Per the documentation at <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html#example-bucket-policies-use-case-4" rel="nofollow noreferrer">Restricting Access to a Specific HTTP Referrer</a> , I've granted access to a given set of domains, and as instructed, denied access to any site except those domains.
  This works all fine and well except when trying to do anything with the root credentials, or any IAM user.</p>
  
  <p>It goes on to say: </p>
  
  <blockquote>
    <p>This example prevents all users (including the root user) from
    performing all Amazon S3 actions, including managing bucket policies.
    Consider adding a third Sid that grants the root user s3:* actions.</p>
  </blockquote>
  
  <p>If Sid#2 is removed, it works, but I see no way to negate that condition if it's the Root User or an IAM record.</p>
  
  <p><strong>The question is HOW to "add a third sid".</strong> </p>
  
  <p>As is abundantly clear, I'm new at AWS permissions. I've tried any number of ways to specify this magical "3rd sid", but quite apparently am doing it incorrectly. I've tried many variations from the docs such as below with no luck or clear idea where/how to grant Root privileges in the policy.</p>
  
  <pre><code>          {
                  "Sid": "Allow Root All Access",
                  "Effect": "Allow",
                  "Principal": {
                       "AWS":"arn:aws:iam::123456789012:root"
                       "AWS": "123456789012",
                       "CanonicalUser": "57bb2cb8as978f89sreuruapouduasp8udc5ba524fe20eb22853f19088600a67"
                  },
                  "Action": "s3:*",
                  "Resource": "arn:aws:s3:::our-bucket/*"
            }
  </code></pre>
  
  <p><strong>Policy implemented from example, and does work (too well)</strong></p>
  
  <pre><code>{
       "Version": "2012-10-17",
       "Id": "http referer policy example",
       "Statement": [
            {
                  "Sid": "Allow get requests originating from Our Site.",
                  "Effect": "Allow",
                  "Principal": "*",
                  "Action": "s3:*",
                  "Resource": "arn:aws:s3:::our-bucket/*",
                  "Condition": {
                       "StringLike": {
                            "aws:Referer": [
                                  "http://www.oursite.com/*",
                                  "https://www.oursite.com/*"
                            ]
                       }
                  }
            },
            {
                  "Sid": "Explicit deny to ensure requests are allowed only from specific referer.",
                  "Effect": "Deny",
                  "Principal": "*",
                  "Action": "s3:*",
                  "Resource": "arn:aws:s3:::our-bucket/*",
                  "Condition": {
                       "StringNotLike": {
                            "aws:Referer": [
                                  "*oursite.com/*"
                            ]
                       }
                  }
            }
       ]
  }
  </code></pre>
  
  <p>Thanks in advance to anyone that can assist!</p>