add comment about FS permission

Signed-off-by: shirady <[email protected]>

Author: shirady

docs/NooBaaNonContainerized/S3Ops.md

@@ -45,9 +45,11 @@ The following lists describe the bucket and object operations available in NooBa
 - Bucket policies are an access policy option available to grant permission to buckets and objects (see [bucket policy](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-policies.html) in AWS documentation). You can use bucket policies to add or deny permissions for the objects in a bucket. Bucket policies can allow or deny requests based on the elements in the policy.
 - Bucket policies use JSON-based policy language (for more information see [basic elements in bucket policy](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-policy-language-overview.html) in AWS documentation)
 - Bucket policy can be added to a bucket using the S3 API or the noobaa-cli.
+- Bucket policy is an additional layer of permission to the FS permission (UID and GID), which mean that if two accounts do not have the same permissions (UID, GID) just setting bucket policy on the bucket is not enough.
 
 **Prerequisites**  
-An account and an bucket, for bucket policy management using the S3 API you would use the NooBaa service. 
+2 accounts and an bucket owned by one of the accounts.  
+For bucket policy management using the S3 API you would use the NooBaa service. 
 
 #### Bucket Policy in NooBaa CLI
 1. Adding a bucket policy:
@@ -60,7 +62,8 @@ In both cases the argument for the bucket policy is a string
 bucket_policy as a string example:
 `'{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":["<account-name>"]},"Action":["s3:*"],"Resource":["arn:aws:s3:::<bucket-name>/*","arn:aws:s3:::<bucket-name>"]}]}'`
 
-Replace `<account-name>` with account name and `<bucket-name>` with a bucket name
+Replace `<account-name>` with account name and `<bucket-name>` with a bucket name.
+Note: `arn:aws:s3:::<bucket-name>` for S3 bucket operations and  `arn:aws:s3:::<bucket-name>/*` for S3 object operations.
 Warning: this policy allows `<account-name>` to run all S3 operations.
 
 #### Bucket Policy in S3 API (using AWS CLI)
@@ -82,7 +85,8 @@ policy.json example:
   ]
 }
 ```
-Replace `<account-name>` with account name and `<bucket-name>` with a bucket name
+Replace `<account-name>` with account name and `<bucket-name>` with a bucket name.
+Note: `arn:aws:s3:::<bucket-name>` for S3 bucket operations and  `arn:aws:s3:::<bucket-name>/*` for S3 object operations.
 Warning: this policy allows `<account-name>` to run all S3 operations.
 
 ##### Principal Field: