Question

A company grants a partner account access to a shared S3 bucket via a bucket policy. The security team wants every principal in the partner account to be allowed to read objects EXCEPT for one specific IAM role named 'ContractorRole', which must never be able to read the objects regardless of that role's identity-based permissions. Which S3 bucket policy construct enforces this most reliably?

Accepted Answer

An Allow statement for the partner account root, plus a Deny statement with Principal set to the ContractorRole ARN for the s3:GetObject action

Answer

An Allow statement with Principal set to the partner account root ARN, plus a separate Deny statement using NotPrincipal to exclude ContractorRole

Answer

A single Allow statement using NotPrincipal set to ContractorRole so all other principals are permitted

Answer

An Allow statement for the partner account root and rely on the partner administrator to attach a permission boundary to ContractorRole