# Exercise 1: Lock Down a Bucket, Then Grant Narrow Cross-Account Access

```
STEP 1. Write a bucket policy that grants ONLY a specific role in ANOTHER
        AWS account (999999999999) read access to objects under the
        "reports/" prefix — nothing else, no write, no other prefix.
STEP 2. Write the CLI command that keeps Block Public Access fully
        enabled on this bucket (it must stay on — this exercise is about
        narrow cross-account access, not public access).
STEP 3. Write the CLI command to generate a 10-minute presigned URL for
        one specific report object, for a THIRD party who has no AWS
        account at all.
STEP 4. Explain in a comment why steps 1 and 3 are solving two different
        problems, even though both "grant access to an object."
```

This is a config-only exercise (JSON + CLI) — no interpreter to run, so verify yourself against the **Requirements Checklist** at the bottom instead of a PASS/FAIL script.

## Bucket Policy (TODO)

```json
{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "CrossAccountReadReportsOnly",
    "Effect": "TODO",
    "Principal": { "AWS": "TODO-the-other-accounts-role-arn" },
    "Action": "TODO-the-read-action",
    "Resource": "TODO-bucket-arn-scoped-to-the-reports-prefix-only"
  }]
}
```

## CLI Commands (TODO)

```bash
# Keep Block Public Access fully on
aws s3api put-public-access-block --bucket my-app-uploads-prod \
  --public-access-block-configuration TODO-all-four-settings-true

# 10-minute presigned URL for one object
aws s3 presign s3://my-app-uploads-prod/reports/q3.csv --expires-in TODO-seconds-for-10-minutes
```

## Requirements Checklist

- [ ] The bucket policy's `Resource` is scoped to `arn:aws:s3:::my-app-uploads-prod/reports/*` — NOT the whole bucket, NOT `"*"`.
- [ ] The bucket policy's `Principal` is the other account's specific role ARN — NOT `{"AWS": "999999999999"}` alone (that would let any identity in that account assume access, not just the intended role) and NOT `"*"`.
- [ ] All four Block Public Access settings remain `true`.
- [ ] `--expires-in` is exactly 600 (10 minutes in seconds).
- [ ] Your comment correctly distinguishes: the bucket policy grants a *known AWS identity in another account* standing access to a *prefix*; the presigned URL grants a *specific unauthenticated party* temporary access to *one object*, with no AWS identity involved on the recipient's side at all.