Reviewed by Aditya Kumar · Last reviewed 2026-03-24
Architectural logic: S3 has IAM and ACLs (legacy). Both must allow—ACLs can deny even if IAM allows. ACLs = per-object/bucket grants. IAM = identity-based. Trade-off: ACLs add complexity; prefer bucket policies + IAM....
Architectural logic: S3 has IAM and ACLs (legacy). Both must allow—ACLs can deny even if IAM allows. ACLs = per-object/bucket grants. IAM = identity-based. Trade-off: ACLs add complexity; prefer bucket policies + IAM. Best practice: Disable ACLs (BucketOwnerEnforced); use IAM for centralized control.
Red Flag: Mixing ACLs and IAM without understanding evaluation order. Pro-Move: 'We disabled ACLs org-wide; BucketOwnerEnforced—IAM only, no ACL surprises.'
According to DataEngPrep.tech, this is one of the most frequently asked Cloud/Tools interview questions, reported at 1 company. DataEngPrep.tech maintains an editor-reviewed database of 1,863 data engineering interview questions across 7 categories.