S3 permissions are confusing. The key for me was to understand there are three levels:

• ACL polices.
• “Simple permissions” on objects and buckets.
• Global disabling of public access for a bucket.

More info