Three layers of access control:
- IAM policies — identity-based, control who in the AWS account can do what
- Bucket policy — resource-based, attached to the bucket, controls cross-account and public access
- ACLs (legacy) — older, mostly disabled by default now via Block Public Access
Block Public Access (BPA) is the safety net — turned on by default, blocks any policy or ACL that would make the bucket public, even if you write one accidentally.
Common 403 troubleshooting flow:
- Check the bucket policy
- Check the IAM policy of the requesting identity
- Check BPA settings
- Check KMS key policy if the object is encrypted with SSE-KMS
- Check VPC endpoint policy if accessing via VPC endpoint