dana and sam are both in developers. Nothing is attached anywhere yet. Grant S3 read access once, to the group:
sh
aws iam attach-group-policy --group-name developers --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
aws s3 ls --profile samDana alone should be able to view budgets. A policy is drafted in ~/budget-view.json; embed it in her user as an inline policy named BudgetView:
sh
aws iam put-user-policy --user-name dana --policy-name BudgetView --policy-document file://budget-view.json
aws iam list-user-policies --user-name dana
aws iam list-attached-user-policies --user-name dana