IAM
3 articles on IAM.
Object tags or prefixes: which access model survives growth
Prefixes decide what a principal can list, tags decide what it can read. Two AWS limits break tag-only designs, and prefix policies run out at about 60 tenants.
Chained AssumeRole sessions stop at one hour, silently
A role that assumes another role gets 3600 seconds, whatever its MaxSessionDuration allows. The exact error, and the batch job that dies at minute 61.
When two policies allow and the request still fails
S3 returns AccessDenied even when the bucket and IAM policies both allow. Here is the five-gate evaluation order and where the hidden deny sits.