> Back in the 2016 timeframe, members of our team were working at AWS and faced a similar challenge. Given all of the awesome complexity of AWS IAM policies, AWS S3 storage policies, historical version support- can we definitively say whether an object in S3 is accessible to the public internet or not?

To be honest AWS accounts are a complete mess and the AWS dashboard does not gracefully handle reduced permissions so this is not an inspiring start.

The policy framework is everything that explains why formal methods has gotten very little traction in day-to-day software engineering, it is extremely difficult to parse (maybe this is a Z3 problem)