A parks photo bucket should allow public read access to thumbnail objects but must deny public write so citizens cannot upload or overwrite objects anonymously. Which S3 data-access design best encodes that policy?

S3 data access policies combine Block Public Access settings with bucket policies that allow only the intended public actions—here public read on thumbnails—while denying anonymous writes. Allowing Principal "*" PutObject or inverting read/write permissions creates integrity risk. Associate candidates must encode the public/private mix deliberately.