S3 Bucket Policies: Who Can Do What to Which Objects

A bucket policy is attached to the bucket itself, so it can grant access to principals outside your own account — that is the key difference from an IAM policy, which is attached to a user or role. It uses the same JSON shape, but adds a Principal that says who the statement covers.

The three fields that matter are Principal (an AWS account, * for everyone, or a specific ARN), Action (the S3 operations, like s3:GetObject), and Resource (the ARN of the bucket or objects). The resource has two forms: arn:aws:s3:::my-bucket for the bucket itself, and arn:aws:s3:::my-bucket/* for the objects inside. Object-level actions such as GetObject need the object ARN; bucket-level actions such as ListBucket need the bucket ARN.

A common refinement is the key prefix. Scope s3:GetObject to arn:aws:s3:::my-bucket/logs/* and only that subtree is public, leaving the rest private. Remember the trailing slash — logs/* covers the intended files, while logs* would also match logsbackup/. Build the statement with the right principal, the narrowest prefix, and the correct ARN form, and the policy does exactly what you expect.