AWS IAM + S3 Demystified: Map Every S3 CLI Command to Its Required Permission

If you have ever stared at an AccessDenied error and played permission roulette, adding one action at a time until something works, this post is for you. We are going to take a short, real S3 bash script, map every single CLI command to the exact IAM permission it requires, and write the smallest possible policy that grants only those actions. What IAM is (in 60 seconds) AWS IAM (Identity and Access Management) answers three questions for every API call: Question IAM concept Who is calling? Identity (user, role, or group) What are they allowed to do? Policy (JSON allow/deny rules) On which resource? Resource ARN The evaluation logic is simple but strict: Default deny — everything is blocked unless explicitly allowed Explicit Allow — grants access Explicit Deny — always wins, even over an Allow That third rule is why least-privilege matters: the more permissions you hand out, the harder it is to audit which Deny you actually need. The script we are dissecting # create a bucket aws s3api