Implementing Data Protection with Resource-Based Policies

This section explores resource-based policies to enforce the principle of least privilege and restrict access to Amazon S3 buckets and objects. By default, S3 buckets are private; only the root user and the IAM account that created a bucket can access it.

In contrast to IAM policies that determine actions for IAM users or roles, resource-based policies are inline policy statements attached to the resource itself. In Amazon S3, these policies are called bucket policies, which specify the allowed access levels against that resource and its access source.

Resource-based policies can also provide additional permission levels, including the ability to grant anonymous access. This feature allows users on the public internet to access your resources. For example, you may offer a free e-book as part of your marketing strategy (without the need to have the end user register for it). Amazon S3 also allows you to host a static website...