A custom IAM policy for a reporting tool should follow least privilege for one S3 prefix. Which policy design best matches that goal?
Select an answer to reveal the explanation.
Short Explanation
Least privilege means the reporting tool gets a reading lamp, not the whole power grid — just GetObject on the one prefix it needs. Narrow the action and the resource, and you shrink what a mistake or breach can touch.
Full Explanation
Least-privilege custom policies restrict both actions and resources to what a principal requires. Allowing only s3:GetObject on a specific prefix is a classic example. Broad wildcards such as or s3: across all buckets violate least privilege and expand blast radius.