title: Why this AWS IAM policy only works with an asterisk on the resource?
body: <p>I'm trying to download some files I already uploaded to S3 with some Python code, but I'm getting headaches trying to use a tight policy.</p>
  
  <p>I can list all the files in the bucket, but when I try do download them with what I see as a correct policy, I get <code>botocore.exceptions.ClientError: An error occurred (403) when calling the HeadObject operation: Forbidden</code></p>
  
  <p>Then, when I was trying to add a different policy that worked for 2 different buckets, I added part of the bucket's name, then the asterisk, and for some reason, the same exact thing worked.</p>
  
  <p>So can someone tell me why this happens?</p>
  
  <p>This for example, is what works like a charm:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "Stmt1499955913000",
              "Effect": "Allow",
              "Action": [
                  "s3:GetObject",
                  "s3:ListBucket"
              ],
              "Resource": "arn:aws:s3:::THE-BEGINING-OF-THE-NAME*"
          }
      ]
  }
  </code></pre>
  
  <p>But this doesn't:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "Stmt1499955913000",
              "Effect": "Allow",
              "Action": [
                  "s3:GetObject",
                  "s3:ListBucket"
              ],
              "Resource": "arn:aws:s3:::THE-EXACT-COMPLETE-FULL-NAME"
          }
      ]
  }
  </code></pre>
  
  <p>I can add the python code for the download if it's relevant, but this questions seems long enough, and the code is pretty straightforward</p>