S3 Access Control: Policies, IAM, and Block Public Access

A Bucket Policy is a resource-based JSON policy attached directly to the bucket, capable of granting access to other AWS accounts, specific IAM roles, or (if deliberately configured) the public — it's the natural place to express 'who besides my own account can access this bucket.'

IAM Policies attached to a user or role control what that identity can do across S3 (and other services), independent of any specific bucket policy — this is the natural place to express 'what can this specific application or person do.' For access within your own account, either mechanism can grant the needed permission; AWS evaluates both together, and an explicit Deny in either one blocks the request regardless of any Allow elsewhere.

S3 Block Public Access is a separate, blunt safety-net setting (available at both the account and bucket level) that can override and block public access even if a bucket policy or object ACL would otherwise grant it — specifically designed to prevent an accidental misconfiguration from actually exposing data, since it requires a second, deliberate action (explicitly disabling Block Public Access) before any public-granting policy takes effect.