"What access does this actually need?" is the first question a security review asks, and the honest answer needs to be in front of the person answering it.

The minimum IAM policy is now published in full: in the dialog where you connect a bucket, in Connecting AWS, and to the support assistant. All three render from one definition, so they cannot drift apart.

s3:DeleteBucket has been removed from the published policy and from both CloudFormation templates. BucketPilot has never used it — there is no feature in the product that deletes a bucket — and it should not have been asked for. A stack you created before this keeps the old permission until you update it, so if you want it gone, update the stack or edit the policy directly.

And a key with a broad s3:* policy now gets a note explaining that it is wider than we need, rather than silence.