Why does access control not have "load object" privileges?

If the ACL allows the bucket to be READed, it is "Allowed to list objects in the bucket."

Also, if you allow an object to be READed, you will be allowed to read the object data and its metadata.

Therefore, if you want to limit オブジェクトload objects の, try configuring ACLs on objects or preventing s3:Get* in bucket policies instead of ACLs.

Please refer to the Developer's Guide for details.
http://docs.aws.amazon.com/ja_jp/AmazonS3/latest/dev/acl-overview.html#permissions