A library consortium attaches an S3 bucket policy that allows public GetObject for open catalogs while denying deletes except to a dedicated backup role. What does this illustrate about secure access design?
Select an answer to reveal the explanation.
Short Explanation
The bucket itself can wear a name tag that says “anyone may read the catalog, but only BackupRole may delete.” That is a resource policy working with identity policies, not instead of them. S3 access is often both who you are and what the bucket allows.
Full Explanation
AWS access evaluation considers identity-based policies and resource-based policies such as S3 bucket policies. A bucket policy can grant public GetObject for open data while denying destructive actions except to a named backup role, tightening control beyond what identity policies alone express. Resource policies do not make identity irrelevant, and they do not require disabling encryption as a prerequisite for public read of specific objects.