Ravi Sir's Cards › AWS
ListBucket and GetObject both need care?
What is a VPC: your own private network inside one AWS Region, example ThreeTierVpc 10.0.0.0/16.
Read card text
What this card says
What it is
ListBucket is on the bucket ARN; GetObject is on object ARNs. Put the right Resource on each statement and attach Condition to each (or carefully combine).
Why it matters
Forgetting Condition on ListBucket can leak object keys even when GetObject is locked down.
s3:ListBucket
How / example
Two statements: ListBucket on arn:…:bucket/lab and GetObject on arn:…:bucket/lab/* — both with the same SourceIp Condition.