为什么此AWS IAM策略仅在资源上带有星号的情况下起作用？

Question

I'm trying to download some files I already uploaded to S3 with some Python code, but I'm getting headaches trying to use a tight policy.

I can list all the files in the bucket, but when I try do download them with what I see as a correct policy, I get botocore.exceptions.ClientError: An error occurred (403) when calling the HeadObject operation: Forbidden

Then, when I was trying to add a different policy that worked for 2 different buckets, I added part of the bucket's name, then the asterisk, and for some reason, the same exact thing worked.

So can someone tell me why this happens?

This for example, is what works like a charm:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1499955913000",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::THE-BEGINING-OF-THE-NAME*"
        }
    ]
}

But this doesn't:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1499955913000",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::THE-EXACT-COMPLETE-FULL-NAME"
        }
    ]
}

I can add the python code for the download if it's relevant, but this questions seems long enough, and the code is pretty straightforward

Answer 1

Seems I just needed some rubber duck debugging, the answer was I think counter intuitive, but easy:

It seems the ARN it's not only an identifier for the AWS resource itself, but also it's content. So, when giving permissions, you need to give permissions to "the bucket" for listing it, and "the content" to download it

Which leads to a policy like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1499955913000",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::THE-EXACT-COMPLETE-FULL-NAME",
                "arn:aws:s3:::THE-EXACT-COMPLETE-FULL-NAME/*"
        }
    ]
}

Which, as I said, gives control over the bucket itself, with no asterisks, and whatever goes after the slash bar