IAM and S3 architecture

1. Choose a workload identity

An application on AWS needs to access S3 without embedding permanent credentials in its source.

What should supply its permissions?

An appropriate IAM role with temporary credentials.

Use workload roles and temporary credentials. Avoid copying long-lived or root credentials into application code.

The workload uses a role rather than an embedded secret.

Workload → role session → temporary credentials

2. Scope the action and resource

The application only needs to read objects under reports/ in one bucket.

Which policy is closest to that need?

Allow s3:GetObject on that bucket’s reports/* object ARN.

An object action needs object resources. ListBucket is a separate bucket-level permission if listing is needed.

Read access is scoped to the required prefix.

{ "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-reports/reports/*" }

3. Diagnose AccessDenied

A request fails even though one policy allows GetObject. Another applicable policy contains an explicit deny.

Which principle explains the result?

An applicable explicit deny overrides an allow.

Check the actual principal, action, resource, conditions, and applicable policies. Do not treat administrator access as a debugging shortcut.

The investigation finds and addresses the intended deny boundary.

Inspect: principal → action → resource → conditions
Then check applicable explicit denies and limiting policies.

Practice, then check your understanding

In the interactive tour, make each decision before seeing the outcome. Wrong answers receive coaching, and replay gives you a fresh attempt without duplicating earned XP.

Read the official AWS documentation for service behavior and production details.