Three people may or may not be able to read invoices-15vv76b: tomas, rosa and omar. Do not try any S3 command: ask the simulator instead.

1. Ask what IAM would decide for tomas and s3:ListBucket on the bucket:

   sh

   copy

   aws iam simulate-principal-policy --policy-source-arn arn:aws:iam::123456789012:user/tomas --action-names s3:ListBucket --resource-arns arn:aws:s3:::invoices-15vv76b

2. Ask the same about rosa, keeping only the decision (the EvalDecision of the first entry in EvaluationResults), and save it as text to ~/rosa.txt.

3. Do the same for omar, into ~/omar.txt.

4. Tomas should never be able to delete the bucket. Check that with the simulator, without trying it.