Policies

SCS3 storage offers three key mechanisms for managing access and objects within a bucket:

• Bucket policies define who can access a bucket and what actions they can perform. These policies allow fine-grained access control by specifying permissions at the bucket and object levels.
• Lifecycle policies automate the management of objects over time, such as deleting older objects or managing versioned objects to optimise storage.
• IAM policies define who can access the AWS IAM api and what actions they can perform. These policies allow users to perform actions such as creating users, groups, keys and bucket policies.

Each bucket can have one bucket policy and one lifecycle policy, but both can contain multiple rules. While bucket policies focus on security and access control, lifecycle policies help streamline storage efficiency and compliance.

There is an overlap between what you can do with IAM and Bucket policies when it comes to S3 actions. If a user has full S3 access with IAM policies, only deny Bucket policies can limit that user, because deny policies take precedence over allow policies. Thus, planning according to the desired access patterns yields simpler and more effective policies.

For more details, refer to the respective sections:

• Bucket Policies
• Lifecycle Policies
• IAM Policies