S3 Policies Explained: Bucket Policies vs IAM Policies vs ACLs

S3 has three overlapping access control systems — bucket policies, IAM policies, and ACLs — and the interaction between them confuses most people the first time. Here's how each one works, when to use