S3 Security: Bucket Policies and ACLs

Securing your S3 data is paramount. AWS provides multiple layers of access control for S3, and understanding how they interact is critical for preventing data breaches. In this lesson, we cover IAM policies, bucket policies, Access Control Lists (ACLs), Block Public Access, and access points.

---

The Four Layers of S3 Access Control

Layer	Scope	Written In	Attached To
IAM policies	User/role-level	JSON	IAM users, groups, roles
Bucket policies	Bucket-level	JSON	The bucket itself
ACLs	Object or bucket level	XML	Bucket or individual objects
Block Public Access	Account or bucket level	Toggle settings	Account or bucket

When a request arrives, S3 evaluates all applicable policies. The request is allowed only if at least one policy grants access and no policy explicitly denies it.

---

IAM Policies for S3

IAM policies control what AWS principals (users, groups, roles) can do with S3. These are identity-based policies.

Example: Allow a user to read from a specific bucket: