202 — S3 Permissions and Bucket Policies

Intermediate

Write an S3 bucket policy for a specific IAM principal, inspect Block Public Access settings, apply and verify the policy, and simulate permissions — all from the CLI.

Learning Objectives

Explain the difference between bucket policies (resource-based) and IAM policies (identity-based)

Inspect the default Block Public Access settings on an S3 bucket

Write a bucket policy JSON that grants read access to a specific IAM principal

Apply and verify a bucket policy using the AWS CLI

Simulate access using aws iam simulate-principal-policy

Remove a bucket policy and clean up exercise resources

Step 1

Create the policy lab bucket

Create a new S3 bucket for this lesson. The bucket name uses your Account ID to ensure global uniqueness.

Commands to Run

BUCKET="devopspath-$(aws sts get-caller-identity \
  --query Account \
  --output text)-policy-lab"

echo "Bucket name: $BUCKET"

aws s3 mb s3://$BUCKET --region us-east-1

What This Does

The BUCKET shell variable stores the unique bucket name for the rest of this lesson.

Using your 12-digit Account ID in the name guarantees global uniqueness without a random suffix.

The variable is set in the current shell session — if you open a new terminal window you will need to re-run the first command to restore it.

Expected Outcome

The echo command prints a name like: devopspath-123456789012-policy-lab

The mb command outputs: make_bucket: devopspath-123456789012-policy-lab

The bucket now exists in us-east-1.

Pro Tips

1
S3 billing callout: on the current Free Plan, S3 usage draws from your Free Tier credits and a free-plan account cannot incur charges; legacy accounts get 5 GB of standard storage free for 12 months. Either way, run the cleanup step at the end of the lesson.
2
Re-export BUCKET if you close and reopen your terminal: BUCKET="devopspath-$(aws sts get-caller-identity --query Account --output text)-policy-lab"

Common Mistakes to Avoid

⚠️Closing the terminal between steps and losing the BUCKET variable — the subsequent steps will fail with 'NoSuchBucket' if $BUCKET is empty. Run the first command again to restore it.
⚠️Creating the bucket in a region different from where you run subsequent commands — always include --region us-east-1 for this lesson.

Was this step helpful?