Sorry for a shameless self-promotion but I've recently written a piece about how it's a common practice to grant web apps a full access to S3 resources using a simple IAM policy and what risks it causes https://pawelurbanek.com/s3-iam-config