S3 Security

Resource X, Y and Z could be different buckets and it shows how it works.

User Based Policies

IAM Policies: - Attached to an IAM user or group to allow or deny what the person can do with the S3 Bucket, e.g. someone might have write and read access and another person might have only read access or something like that.

Resource Based Policies

Bucket Policy: - JSON based policy (similar to IAM policies) - Contains: Resources (which objects and buckets is this policy for), Actions (which permission you want to allow or deny), Effect (whether you want to 'allow' or 'deny' it), Principle (who are you defining all of this for, e.g. an account, a user, a service, etc.) - Define who can access the bucket (you can grant public access with the bucket policy or grant another AWS account access to the bucket (known as Cross Account access).

Access Control Lists: - Much less common and is not recommended as much as bucket policies.

Encryption

• Can encrypt objects in S3 with encryption keys to ensure that only you can read the data.