S3 Access Control: Policies, IAM, and Block Public Access
~12 min read
Three layers that combine to decide whether a given S3 request is allowed.
S3 Access Control: Policies, IAM, and Block Public Access is a Pro topic
Sign in, then upgrade to Pro or Power to unlock this topic and the full AWS curriculum.
Key points
- •Bucket policy: resource-based, attached to the bucket, can grant cross-account or public access
- •IAM policy: identity-based, attached to a user/role, controls what that identity can do
- •Both evaluated together; explicit Deny in either wins
- •Block Public Access is a safety-net override requiring deliberate action to disable