What Are the Differences Between Using an IAM Policy and a Bucket Policy in Access Control?

IAM policies apply to cloud resources. With the OBS permissions, an IAM policy can be applied to all buckets and objects, or it can be applied only to specified buckets and objects. IAM policies are recommended if you assign permissions to IAM users of the same account.

A bucket policy only applies to the bucket the policy was configured for.