diff --git a/docs/data-sources/object_storage_bucket_policy_document.md b/docs/data-sources/object_storage_bucket_policy_document.md
index 61008eec..730a301d 100644
--- a/docs/data-sources/object_storage_bucket_policy_document.md
+++ b/docs/data-sources/object_storage_bucket_policy_document.md
@@ -13,15 +13,42 @@ description: |-
 ## Example Usage
 
 ```terraform
+terraform {
+  required_providers {
+    coreweave = {
+      source = "coreweave/coreweave"
+    }
+  }
+}
+
+variable "bucket_name" {
+  type        = string
+  description = "Name of the bucket to allow access to."
+}
+
+variable "org_id" {
+  type        = string
+  description = "CoreWeave organization ID to match in the bucket policy condition."
+}
+
 data "coreweave_object_storage_bucket_policy_document" "default" {
   version = "2012-10-17"
   statement {
-    sid      = "allow-all"
-    effect   = "Allow"
-    action   = ["s3:*"]
-    resource = ["arn:aws:s3:::*"]
+    sid    = "AllowUserAndGroup"
+    effect = "Allow"
+    action = ["s3:*"]
+    resource = [
+      "arn:aws:s3:::${var.bucket_name}",
+      "arn:aws:s3:::${var.bucket_name}/*",
+    ]
     principal = {
-      "CW" : ["*"]
+      "CW"  = ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"]
+      "AWS" = ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"]
+    }
+    condition = {
+      "StringEquals" : {
+        "cw:PrincipalOrgID" : var.org_id
+      }
     }
   }
 }
diff --git a/docs/resources/object_storage_bucket_policy.md b/docs/resources/object_storage_bucket_policy.md
index 0c5a95ed..eac5dc15 100644
--- a/docs/resources/object_storage_bucket_policy.md
+++ b/docs/resources/object_storage_bucket_policy.md
@@ -15,18 +15,40 @@ description: |-
 ```terraform
 ## Example using jsonencode to pass a raw JSON string to the policy attribute
 
+terraform {
+  required_providers {
+    coreweave = {
+      source = "coreweave/coreweave"
+    }
+  }
+}
+
+variable "org_id" {
+  type        = string
+  description = "CoreWeave organization ID to match in the bucket policy condition."
+}
+
 locals {
   bucket_policy = {
     Version = "2012-10-17"
     Statement = [
       {
-        Sid    = "allow-all"
+        Sid    = "AllowUserAndGroup"
         Effect = "Allow"
         Principal = {
-          "CW" : "*"
+          "CW"  = ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"]
+          "AWS" = ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"]
+        }
+        Action = ["s3:*"]
+        Resource = [
+          "arn:aws:s3:::${coreweave_object_storage_bucket.raw.name}",
+          "arn:aws:s3:::${coreweave_object_storage_bucket.raw.name}/*",
+        ]
+        Condition = {
+          "StringEquals" = {
+            "cw:PrincipalOrgID" = [var.org_id]
+          }
         }
-        Action   = ["s3:*"]
-        Resource = ["arn:aws:s3:::${coreweave_object_storage_bucket.raw.name}"]
       },
     ]
   }
@@ -52,27 +74,40 @@ resource "coreweave_object_storage_bucket" "doc" {
 data "coreweave_object_storage_bucket_policy_document" "doc" {
   version = "2012-10-17"
   statement {
-    sid      = "allow-all"
-    effect   = "Allow"
-    action   = ["s3:*"]
-    resource = ["arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}"]
+    sid    = "AllowUserAndGroup"
+    effect = "Allow"
+    action = ["s3:*"]
+    resource = [
+      "arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}",
+      "arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}/*",
+    ]
     principal = {
-      "CW" : ["*"]
+      "CW"  = ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"]
+      "AWS" = ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"]
+    }
+    condition = {
+      "StringEquals" : {
+        "cw:PrincipalOrgID" : var.org_id
+      }
     }
   }
 
   statement {
-    sid      = "DenyIfPrefixEquals"
+    sid      = "DenyIfPrefixNotEquals"
     effect   = "Deny"
     action   = ["s3:ListBucket"]
     resource = ["arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}"]
     principal = {
-      "CW" : ["*"]
+      "CW"  = ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"]
+      "AWS" = ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"]
     }
     condition = {
       "StringNotEquals" : {
         "s3:prefix" : "projects"
       }
+      "StringEquals" : {
+        "cw:PrincipalOrgID" : var.org_id
+      }
     }
   }
 }
diff --git a/examples/data-sources/coreweave_object_storage_bucket_policy_document/data-source.tf b/examples/data-sources/coreweave_object_storage_bucket_policy_document/data-source.tf
index 794b86ff..45b56d98 100644
--- a/examples/data-sources/coreweave_object_storage_bucket_policy_document/data-source.tf
+++ b/examples/data-sources/coreweave_object_storage_bucket_policy_document/data-source.tf
@@ -1,12 +1,39 @@
+terraform {
+  required_providers {
+    coreweave = {
+      source = "coreweave/coreweave"
+    }
+  }
+}
+
+variable "bucket_name" {
+  type        = string
+  description = "Name of the bucket to allow access to."
+}
+
+variable "org_id" {
+  type        = string
+  description = "CoreWeave organization ID to match in the bucket policy condition."
+}
+
 data "coreweave_object_storage_bucket_policy_document" "default" {
   version = "2012-10-17"
   statement {
-    sid      = "allow-all"
-    effect   = "Allow"
-    action   = ["s3:*"]
-    resource = ["arn:aws:s3:::*"]
+    sid    = "AllowUserAndGroup"
+    effect = "Allow"
+    action = ["s3:*"]
+    resource = [
+      "arn:aws:s3:::${var.bucket_name}",
+      "arn:aws:s3:::${var.bucket_name}/*",
+    ]
     principal = {
-      "CW" : ["*"]
+      "CW"  = ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"]
+      "AWS" = ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"]
+    }
+    condition = {
+      "StringEquals" : {
+        "cw:PrincipalOrgID" : var.org_id
+      }
     }
   }
 }
diff --git a/examples/resources/coreweave_object_storage_bucket_policy/resource.tf b/examples/resources/coreweave_object_storage_bucket_policy/resource.tf
index 47827028..06d6bf25 100644
--- a/examples/resources/coreweave_object_storage_bucket_policy/resource.tf
+++ b/examples/resources/coreweave_object_storage_bucket_policy/resource.tf
@@ -1,17 +1,39 @@
 ## Example using jsonencode to pass a raw JSON string to the policy attribute
 
+terraform {
+  required_providers {
+    coreweave = {
+      source = "coreweave/coreweave"
+    }
+  }
+}
+
+variable "org_id" {
+  type        = string
+  description = "CoreWeave organization ID to match in the bucket policy condition."
+}
+
 locals {
   bucket_policy = {
     Version = "2012-10-17"
     Statement = [
       {
-        Sid    = "allow-all"
+        Sid    = "AllowUserAndGroup"
         Effect = "Allow"
         Principal = {
-          "CW" : "*"
+          "CW"  = ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"]
+          "AWS" = ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"]
+        }
+        Action = ["s3:*"]
+        Resource = [
+          "arn:aws:s3:::${coreweave_object_storage_bucket.raw.name}",
+          "arn:aws:s3:::${coreweave_object_storage_bucket.raw.name}/*",
+        ]
+        Condition = {
+          "StringEquals" = {
+            "cw:PrincipalOrgID" = [var.org_id]
+          }
         }
-        Action   = ["s3:*"]
-        Resource = ["arn:aws:s3:::${coreweave_object_storage_bucket.raw.name}"]
       },
     ]
   }
@@ -37,27 +59,40 @@ resource "coreweave_object_storage_bucket" "doc" {
 data "coreweave_object_storage_bucket_policy_document" "doc" {
   version = "2012-10-17"
   statement {
-    sid      = "allow-all"
-    effect   = "Allow"
-    action   = ["s3:*"]
-    resource = ["arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}"]
+    sid    = "AllowUserAndGroup"
+    effect = "Allow"
+    action = ["s3:*"]
+    resource = [
+      "arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}",
+      "arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}/*",
+    ]
     principal = {
-      "CW" : ["*"]
+      "CW"  = ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"]
+      "AWS" = ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"]
+    }
+    condition = {
+      "StringEquals" : {
+        "cw:PrincipalOrgID" : var.org_id
+      }
     }
   }
 
   statement {
-    sid      = "DenyIfPrefixEquals"
+    sid      = "DenyIfPrefixNotEquals"
     effect   = "Deny"
     action   = ["s3:ListBucket"]
     resource = ["arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}"]
     principal = {
-      "CW" : ["*"]
+      "CW"  = ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"]
+      "AWS" = ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"]
     }
     condition = {
       "StringNotEquals" : {
         "s3:prefix" : "projects"
       }
+      "StringEquals" : {
+        "cw:PrincipalOrgID" : var.org_id
+      }
     }
   }
 }