Introduction

Amazon S3 is one of the most widely used AWS services, and also one of the most common sources of data leaks. Almost every S3 breach in the news comes down to one thing: a misconfigured access policy.

In this article, I'll explain the two main ways of controlling access to S3, IAM policies and bucket policies, show when to use each, and walk through a hands-on example you can try in your own account.

How S3 Access Is Evaluated

Before writing any policy, it helps to know how AWS decides whether a request is allowed:

Everything is denied by default.

An explicit Allow in a relevant policy grants access.

An explicit Deny always wins, no matter what else says Allow.

For requests within the same account, access is granted if either the IAM policy or the bucket policy allows it (and nothing denies it).

Remember this rule: Explicit Deny > Allow > Default Deny.

IAM Policies vs Bucket Policies

Feature IAM Policy Bucket Policy

Attached to IAM user, group, or role The S3 bucket

Answers the…