Role isn't evaluated but S3 bucket policy is-CodePudding

The

I was mislead into thinking that the policy that applies to a request is the "least-privilege union" of all the policies. This is very close to being right but it is untrue.

All policies are parsed.

If there is an explicit deny ("Effect": "Deny") then the whole thing is denied.

If there isn't an explicit deny then it starts looking for implicit denies (this is when the policy doesn't have an "Effect": "Allow" clause that lets me do a thing). EXCEPT the resource based policies let you short circuit the search for implicit denies. If a resource explicitly allows you then you skip: permission boundaries, session policy, and identity policy (which includes roles and IAM).

If you have a resource based policy that approves an action the role policies will only have an effect if there is an explicit deny.

Concerning the part where I said that before I put the S3 policy on I was being denied access, It's probably because of the cognito aud. I was using the wrong aud for a while (the cognito aud being refereed to comes from cognito-identity pools not cognito user pools just in case anyone was curious) and eventually figured it out and used the right one. I must have started testing s3 policy before changing the aud to the right thing.