How would you give a user read-only access to one specific S3 bucket?
Attach an identity policy that allows s3:ListBucket on the bucket ARN and s3:GetObject on the objects inside it using the bucket ARN with /*. Nothing else is allowed, so the user can read but not write or delete.
Explain it simply
It is like giving a library member a card for one reading room only. Permission to see the room's shelf list is separate from permission to take a book from the shelf, and you need to name both clearly.
Example
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ListTheBucket",
"Effect": "Allow",
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::college-notes"
},
{
"Sid": "ReadObjects",
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::college-notes/*"
}
]
}Two different resource ARNs are needed: ListBucket applies to the bucket itself, while GetObject applies to objects, which is why the second one ends in /*. Putting both on one ARN is the most common reason a policy does not work.
This follows least privilege: only the actions and resources required for the job. Avoid "Action": "*" and "Resource": "*" except in tightly controlled cases. Attach the policy to a group or role rather than directly to individual users where possible.
What to say in the interview
"I allow s3:ListBucket on the bucket ARN and s3:GetObject on the bucket ARN with /, attached to a group or role. Bucket-level and object-level actions use different resources, and I keep to least privilege instead of s3:."
Common mistakes
- Forgetting the /* resource, so GetObject fails.
- Granting s3:* because it is quicker.