Bucket policies for access control in AWS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a bucket policy in AWS S3?

A bucket policy is a set of rules in JSON format that defines who can access an S3 bucket and what actions they can perform on it.

intermediate

How does a bucket policy differ from IAM policies?

Bucket policies are attached directly to an S3 bucket to control access to that bucket, while IAM policies are attached to users, groups, or roles to control their permissions across AWS services.

beginner

What is the effect of the "Effect": "Deny" statement in a bucket policy?

It explicitly blocks the specified actions for the defined users or conditions, overriding any allow permissions.

intermediate

Can bucket policies restrict access based on IP address?

Yes, bucket policies can include conditions to allow or deny access based on the requester's IP address or IP range.

beginner

What happens if no bucket policy is attached to an S3 bucket?

By default, the bucket is private, and only the bucket owner has access unless permissions are granted through other means like IAM policies or ACLs.

What does a bucket policy primarily control?

A Who can access the bucket and what actions they can perform

B The physical location of the bucket

C The cost of storing data in the bucket

D The encryption method used for objects

Bucket policies define access permissions for users and actions on the bucket.

Which JSON element in a bucket policy specifies whether access is allowed or denied?

A Action

B Resource

C Effect

D Principal

The "Effect" element specifies "Allow" or "Deny" for the policy statement.

Can a bucket policy grant access to all users on the internet?

A No, bucket policies cannot grant public access

B Only if the user has an AWS account

C Only if the bucket is encrypted

D Yes, by setting Principal to "*"

Setting Principal to "*" allows access to everyone, making the bucket public.

Which condition can be used in a bucket policy to restrict access by IP address?

A "IpAddress"

B "StringEquals"

C "Bool"

D "NumericLessThan"

The "IpAddress" condition restricts access based on IP addresses.

If a bucket policy denies access to a user, what happens if an IAM policy allows it?

A Access is allowed because IAM policies have priority

B Access is denied because deny overrides allow

C Access is allowed only during business hours

D Access is denied only if MFA is not used

Explicit deny in bucket policies overrides any allow permissions.

Explain how bucket policies control access to an S3 bucket.

Think about rules that say who can do what with the bucket.

Describe the difference between a bucket policy and an IAM policy.

Consider where each policy is applied and what it controls.