A large company is using AWS Organizations to manage its multi-account AWS environment.

To ensure that all users within the AWS Organization have read-level access to a specific Amazon S3 bucket, while preventing access outside the organization, you can specify a wildcard principal ("Principal": "*") and use the PrincipalOrgId condition key in the bucket policy.

Specify the Principal:

Use "Principal": "*". This means that any principal can access the bucket, but the actual access will be controlled by the condition.

Add Condition with PrincipalOrgId:

Add a condition to restrict access based on the PrincipalOrgId. This condition ensures that only the principals from the specified AWS Organization can access the bucket.

Example bucket policy:

{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Principal": "*",

"Action": "s3:GetObject",

"Resource": "arn:aws:s3:::bucket-name/*",

"Condition": {

"StringEquals": {

"aws:PrincipalOrgID": "o-exampleorgid"

}

}

}

]

}