[{"data":1,"prerenderedAt":48},["ShallowReactive",2],{"tag-access-control":3,"tag-all":21},[4,14],{"_path":5,"title":6,"description":7,"date":8,"tags":9},"\u002Fblog\u002Fabac-object-tags-vs-prefix-policies","Object tags or prefixes: which access model survives growth","Prefixes decide what a principal can list, tags decide what it can read. Two AWS limits break tag-only designs, and prefix policies run out at about 60 tenants.","2026-11-03",[10,11,12,13],"s3","iam","governance","access-control",{"_path":15,"title":16,"description":17,"date":18,"tags":19},"\u002Fblog\u002Fbucket-policy-allow-still-denied","When two policies allow and the request still fails","S3 returns AccessDenied even when the bucket and IAM policies both allow. Here is the five-gate evaluation order and where the hidden deny sits.","2026-10-30",[10,11,20,13],"security",[22,24,28,30,33,36,41,46],{"tags":23},[10,11,12,13],{"tags":25},[10,11,26,27],"sts","aws",{"tags":29},[10,11,20,13],{"tags":31},[10,20,32],"uploads",{"tags":34},[10,20,35],"presigned-urls",{"tags":37},[10,38,39,40],"tutorial","tooling","seaweedfs",{"tags":42},[10,43,44,45],"pricing","cloud","cost-optimisation",{"tags":47},[10,44],1793734272701]