AWS S3 – Access Management

1. Access Points

Think of it like: A building with multiple doors — each team gets their own door with their own key.

Instead of one big gate (bucket policy) that everyone fights over, each app or team gets their own private entrance.

Example:

• Finance team → their own door → only sees finance files
• HR team → their own door → only sees HR files
• Both teams use the same S3 bucket underneath

When to use: You have multiple teams or apps sharing one S3 bucket.

2. Access Points for FSx

Think of it like: A shared office building where each company gets their own floor.

FSx is a file storage system (like a shared network drive). Access Points for FSx lets each app access only their own folder — they can’t see other floors.

Example:

• App A → sees only /data/finance/
• App B → sees only /data/engineering/
• Same FSx file system underneath

When to use: Multiple apps share one FSx file storage but need to be isolated from each other.

3. Access Grants

Think of it like: A company ID card system — swipe your work badge to get into the right room.

Instead of creating AWS accounts for every employee, you connect your company’s existing user directory (like Microsoft Active Directory) directly to S3.

Example:

• Alice from Finance logs in with her company account → automatically gets access to the finance S3 folder
• No need to create a separate AWS user for Alice

When to use: You have hundreds or thousands of corporate users who need access to S3 data.

4. IAM Access Analyzer

Think of it like: A security guard who checks all the doors and windows and tells you which ones are accidentally left open.

It automatically scans your S3 buckets and alerts you if something is publicly exposed or shared with the wrong AWS account — even by mistake.

Example:

• Someone accidentally makes a bucket public → Access Analyzer immediately flags it
• A bucket is shared with an external account you don’t recognize → you get a finding

When to use: Always. Turn it on and let it run in the background to catch security issues automatically.

Quick Comparison

| Tool | Think of it as… | Best For | |||| | Access Points | Separate doors for each team | Multiple teams sharing one S3 bucket | | Access Points for FSx | Separate floors in a building | Multiple apps sharing one file system | | Access Grants | Company ID card swipe | Corporate users accessing S3 data | | IAM Access Analyzer | Security guard checking open doors | Detecting accidental public/wrong access |

One-Line Summary

Access Points = one bucket, many doors. FSx Access Points = one file system, many floors. Access Grants = use your work login for S3. IAM Access Analyzer = finds doors you forgot to lock.