Status: IN
S3 has three independent permission mechanisms: identity-based IAM policies, bucket policies (resource-based), and ACLs — each evaluated separately.
Source: entries/2026/03/11/IAM-latest-UserGuide-access_policies_identity-vs-resourcehtml.md