S3 Regional Namespace
Generator & Validator
Generate valid account-regional S3 bucket names, validate naming rules, and instantly get Terraform / CloudFormation / CLI / PHP boilerplate — all in your browser.
Namespace Generator
IaC & SDK Boilerplate
# Fill in the form above to generate your AWS CLI command
# Fill in the form above to generate Terraform code
# Fill in the form above to generate CloudFormation YAML
# Fill in the form above to generate Python / Boto3 code
# Fill in the form above to generate PHP / AWS SDK code
s3:x-amz-bucket-namespace condition key. Attach it to your root OU or specific OUs.
# Fill in the form above to generate the SCP / IAM policy JSON
About S3 Regional Namespaces
What Is the Amazon S3 Account Regional Namespace?
On March 12, 2026, AWS launched a major quality-of-life improvement for S3: Account Regional Namespaces for general purpose buckets. For over a decade, developers faced the frustrating reality that S3 bucket names were globally unique — meaning a name like my-app-logs could be taken by any account anywhere in the world.
The new account-regional namespace scopes bucket names to your AWS account + region. The bucket name format is:
{prefix}-{12-digit-accountId}-{region}-an
The -an suffix is the account-namespace indicator. Only your AWS account can create buckets with your account's suffix — requests from other accounts are automatically rejected by AWS.
✅ Who Benefits
Platform teams standardising naming conventions, IaC authors who want predictable bucket names across environments, and orgs migrating to a multi-account AWS Landing Zone.
⚠️ What Doesn't Change
You cannot rename existing global buckets. S3 table buckets, vector buckets, and directory buckets are unaffected — they already use account-level or zonal namespaces.
🔒 Enforce Org-Wide
Use the new s3:x-amz-bucket-namespace IAM condition key in SCPs to prevent anyone in your AWS Organization from creating buckets in the old global namespace.
🌍 Availability
Available in all 37 AWS Regions including AWS China (cn-north-1, cn-northwest-1) and AWS GovCloud (US) Regions. No additional cost.
S3 Naming Rules for Account-Regional Buckets
- The combined name (prefix + account ID + region +
-an) must be 3–63 characters. - Only lowercase letters, numbers, and hyphens are allowed — no underscores, dots, or uppercase.
- The full name must not start or end with a hyphen.
- The name must not resemble an IP address (e.g.,
192.168.5.4). - Dots are technically allowed but not recommended because they break TLS wildcard certificate matching.
CloudFormation Pseudo-Parameters
AWS CloudFormation makes account-regional bucket names trivial using built-in pseudo parameters. Use AWS::AccountId and AWS::Region — no hardcoding required. The generator above outputs a ready-to-use CloudFormation YAML snippet for both the BucketName and BucketNamePrefix approaches.
Frequently Asked Questions
aws s3 sync), update all access policies and application references, then delete the old bucket when ready.--{az-id}--x-s3. S3 table buckets and vector buckets use an account-level namespace. The new account-regional namespace is specifically for general purpose buckets, which is the most common bucket type.https://{bucket-name}.s3.{region}.amazonaws.com. The account-regional namespace only affects how the bucket name is validated and owned — all S3 features, endpoints, SDKs, and APIs work identically.StringNotEquals: s3:x-amz-bucket-namespace: account-regional with a Deny effect forces all bucket creation to use the new namespace org-wide.More Free Online Tools
Simple tools. Surgical fixes. Zero friction.
Amazon Connect CCP Log Parser
Parse Amazon Connect CCP logs into structured, searchable diagnostics.
OpenAmazon Connect Agent Workstation Validator
Pre-flight check for Amazon Connect softphone agents.
OpenAmazon Connect Pricing Calculator
Instantly estimate monthly AWS Connect costs — voice, chat, email, campaigns, telephony & more.
OpenConnect CloudWatch Log Analyzer
Drop any Amazon Connect CloudWatch log and get a rich visual breakdown.
Open