Managing S3 permissions
S3 is one of the oldest service offerings in the AWS services portfolio. It is safe to say that S3 is a widely used service on AWS and stores literally trillions of files as objects. Users can interact with S3 directly via the AWS web console or via a variety of third-party tools or CLI/APIs. By default, all the buckets and objects are private. Only the resource owner has access to it and can grant access to the buckets/objects. There are broadly two ways that you can manage access to S3. One is by defining the S3 resource based policies and the other one is through IAM. S3 resource based policies are further divided into two categories:
- Bucket policy
- Access Control List (ACL)
IAM policies
As discussed in Chapter 4, AWS Identity and Access Management, IAM policies are constructs within an AWS account that defines what a user can and cannot do. In the context of S3, IAM policies are useful because they can be applied to users, roles, and groups.
To demonstrate an IAM policy...
