I read https://aws.amazon.com/blogs/security/iam-policies-and-bucket-policies-and-acls-oh-my-controlling-access-to-s3-resources/, which to me answered the what and when, but not why.
I’m new to AWS and trying to learning it.
Why create two methods, and not just one? Based on the example in the article, why not just have IAM policy to handle both use cases, example like having IAM policy JSON include the ‘Principal’ entry as “base on association” or “??”, then it work like the Bucket policy. It look like for any services which require policy control will have another type of policy created. Example; YYY service policy will have a Principal and Action “YYY:”.
Reason I can think of is, S3 is where require lot of access control (like fine grain, grouping, etc..) and having a policy created specific S3 can ease management, and take less back-end resources?