Bucket policies for access control in AWS - Step-by-Step Execution

Process Flow - Bucket policies for access control

Create Bucket

↓

Write Bucket Policy

↓

Attach Policy to Bucket

↓

Request Access

↓

Evaluate Policy

↓

Access Granted

This flow shows creating a bucket, attaching a policy, then requests are checked against the policy to allow or deny access.

Execution Sample

AWS

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::example-bucket/*"
  }]
}

This bucket policy allows anyone to read objects from the example-bucket.

Process Table

Step	Action	Policy Evaluated	Result	Access Outcome
1	Request to read object	Check if s3:GetObject allowed for Principal *	Effect: Allow	Access Granted
2	Request to write object	Check if s3:PutObject allowed for Principal *	No matching Allow found	Access Denied
3	Request to delete object	Check if s3:DeleteObject allowed for Principal *	No matching Allow found	Access Denied
4	Request to read object with Deny policy added	Explicit Deny overrides Allow	Effect: Deny	Access Denied

💡 Requests stop after policy evaluation grants or denies access.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4
Access Outcome	None	Granted	Denied	Denied	Denied
Policy Effect	None	Allow	No Allow	No Allow	Deny

Key Moments - 2 Insights

Why does a read request succeed but a write request fail?

Because the policy explicitly allows s3:GetObject (read) but does not allow s3:PutObject (write), so write requests are denied as shown in execution_table rows 1 and 2.

What happens if there is both an Allow and a Deny for the same action?

The Deny always wins and blocks access, as shown in execution_table row 4 where Deny overrides Allow.

Visual Quiz - 3 Questions

Look at the execution table, what is the Access Outcome at Step 2 when a write request is made?

A Access Denied

B Access Pending

C Access Granted

D Access Unknown

💡 Hint

Check the 'Access Outcome' column for Step 2 in the execution_table.

At which step does an explicit Deny override an Allow?

A Step 1

B Step 4

C Step 3

D Step 2

💡 Hint

Look at the 'Policy Effect' and 'Access Outcome' columns in execution_table row for Step 4.

If the policy added s3:PutObject Allow, how would Step 2's Access Outcome change?

A It would cause an error

B It would remain Access Denied

C It would change to Access Granted

D It would be Access Pending

💡 Hint

Refer to variable_tracker showing how Access Outcome depends on Policy Effect.

Concept Snapshot

Bucket policies control who can do what with your bucket.
They use JSON statements with Effect (Allow or Deny), Principal, Action, and Resource.
Requests are checked against policies; Deny overrides Allow.
Use policies to grant or restrict access to bucket objects.
Always test policies to confirm expected access.

Full Transcript

Bucket policies are JSON documents attached to S3 buckets to control access. The flow starts with creating a bucket, writing a policy, and attaching it. When a request comes in, AWS checks the policy statements to decide if the request is allowed or denied. If the policy allows the action for the requester, access is granted. If no allow matches or there is an explicit deny, access is denied. Deny always overrides allow. For example, a policy allowing s3:GetObject lets anyone read objects, but write or delete requests are denied if not allowed. Adding an explicit deny blocks access even if allow exists. This visual trace shows step-by-step how requests are evaluated and access outcomes decided.