For anyone who isn't clear on what exactly this entails, but have some experience with AWS: it's a bit [a lot] like S3 bucket policies.