So the library we used to interact with s3 had this very cool delete function. (Pseudocode)

function delete(bucket, file)
request = buildRequest(bucket, file)
sendRequest(request)
OK

Now imagine how many problems we setup without delete permission, because we assumed this librsry actually returns an error code