Why this AWS IAM policy only works with an asterisk on the resource?

I'm trying to download some files I already uploaded to S3 with some Python code, but I'm getting headaches trying to use a tight policy.

I can list all the files in the bucket, but when I try do download them with what I see as a correct policy, I get botocore.exceptions.ClientError: An error occurred (403) when calling the HeadObject operation: Forbidden

Then, when I was trying to add a different policy that worked for 2 different buckets, I added part of the bucket's name, then the asterisk, and for some reason, the same exact thing worked.

So can someone tell me why this happens?

This for example, is what works like a charm:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1499955913000",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::THE-BEGINING-OF-THE-NAME*"
        }
    ]
}

But this doesn't:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1499955913000",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::THE-EXACT-COMPLETE-FULL-NAME"
        }
    ]
}

I can add the python code for the download if it's relevant, but this questions seems long enough, and the code is pretty straightforward