Access control
2 articles on Access control.
Object tags or prefixes: which access model survives growth
Prefixes decide what a principal can list, tags decide what it can read. Two AWS limits break tag-only designs, and prefix policies run out at about 60 tenants.
When two policies allow and the request still fails
S3 returns AccessDenied even when the bucket and IAM policies both allow. Here is the five-gate evaluation order and where the hidden deny sits.