Kinesis Firehose uses an IAM role to deliver data, so delivery within the same account does not necessarily depend on permissions on the bucket. Removing s3:* p

Kinesis Firehose uses an IAM role to deliver data, so delivery within the same account does not necessarily depend on permissions on the bucket. Removing s3:* permissions from that IAM role or adding an explicit deny statement to the bucket policy would stop the flow of data. https://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html#using-iam-s3 https://docs.aws.amazon.com/firehose/latest/dev/controlling-... https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p...