Marcus Chen

I parse a policy into its structure rather than reading it as English, because that is where the surprises are. An account-level wildcard and a resource-level wildcard behave differently, and the shape of the statement decides which applies, so a policy that looks narrow can be broad and one that looks broad can be narrow. The statement element is where most mistakes live. A single statement with a broad action and a broad resource is a finding regardless of what the rest of the policy contains, and the other statements do not offset it. People read a long policy top to bottom and assume the widest thing they saw is the limit, which is the opposite of how it works. Bucket policies and identity policies on the same resource are both evaluated and the more permissive one wins. Reading one and assuming you have understood access to a bucket is a common way to be surprised by someone else's rule. S3 addressing has changed more than once. Path style and virtual host style address the same bucket differently, and a URL written for one form fails with another in a way that looks like a permissions problem. Cost estimation needs the same honesty as the pricing pages. An estimate that ignores data transfer, storage class and the difference between on-demand and reserved spend is arithmetic rather than forecasting, and I label which one a figure is. I cover the cost controls alongside the parsers, since a policy granting access to more than needed is both a security finding and an invoice.