Ravindra BagaleCourses & study guides मराठी Track your progress

Ravi Sir's Cards › AWS

Write a least-privilege S3 read policy

What is a VPC: your own private network inside one AWS Region, example ThreeTierVpc 10.0.0.0/16.

Write a least-privilege S3 read policy AmazonS3FullAccess on a demo role teaches the wrong habit. A customer-managed policy with s3:GetObject (and ListBucket if needed) on one bucket ARN is enough for a read lab. IAM → Policies → Create → JSON with Version 2012-10-17 and Resource arn:aws:s3:::lab-bucket/*. Policy simulator or CLI get-object succeeds; delete-object is denied.
Write a least-privilege S3 read policy · Download PNG
Read card text

What this card says

Why do we need it?

AmazonS3FullAccess on a demo role teaches the wrong habit.

What is it?

A customer-managed policy with s3:GetObject (and ListBucket if needed) on one bucket ARN is enough for a read lab.

How to do it

IAM → Policies → Create → JSON with Version 2012-10-17 and Resource arn:aws:s3:::lab-bucket/*.

s3:GetObject

Example

Policy simulator or CLI get-object succeeds; delete-object is denied.

See all AWS revision cards