title: s3 bucket public access to only certain objects
body: <p>I'm trying to configure an S3 bucket such that all objects are private except certain objects. I'm using a bucket policy like this:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Principal": "*",
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::foo/*",
              "Condition": {
                  "StringEquals": {
                      "s3:ExistingObjectTag/public": "true"
                  }
              }
          }
      ]
  }
  </code></pre>
  
  <p>And then, of course, tagging certain objects as "public:true". When I add this bucket policy but do nothing else then all objects are available publically whether they've been tagged that way or not. I've tried different combinations on the "Block public access" screen but I either get everything allowed or everything denied. And then there's the Access Control List screen which I haven't done anything with:</p>
  
  <p><a href="https://i.stack.imgur.com/RVQzP.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/RVQzP.png" alt="screen shot of Access Control List screen"></a></p>
  
  <p>I also haven't done anything inside IAM. I'm guessing this disconnect is that I don't know how all these different methods of access control interact. My use case seems pretty simple: deny all except certain objects. What's they best way to achieve that? </p>