Is it necessary to specify resource in S3 Bucket Policies?
Yes, Resource is a required element on S3 bucket policies. If the resource is omitted, the API will respond with an error resembling this one below.

status code: 400
Error putting S3 policy: MalformedPolicy: Statement is missing required element


The reasoning is that each statement could apply to the bucket itself, the contents of the bucket, or some subset of the bucket contents, and it's up to the user to clarify. In theory AWS could provide a default that includes both the bucket and all of its contents, but that design probably wasn't chosen because it makes it too easy to accidentally make the bucket policies broader than expected.

Additionally, it is not permissible to use a wildcard in the resource element of an S3 bucket policy. Attempts to do so will yield an error such as this:

Error putting S3 policy: MalformedPolicy: Policy has invalid resource