Give minimal IAM permissions for S3 actions

Why a separate guide on this? AWS offers the option to generate permissions based on Cloudtrail logs. That's great for management events, however it doesn't work well for data events. But why? AWS' policy generation gives you nothing: And Cloudtrai...