# S3 Bucket Policy and IAM Policy

* IAM policies are attached to users, roles, groups.
* S3 bucket policies are attached to buckets.
* When evaluating if IAM Principal can perform an operation X on a bucket, **the union of its assigned IAM policies and S3 bucket policies will be evaluated**.
