@thegibson @Gargron
Okay, here's the script I used:
https://gist.github.com/aurynn/5338a119d54bc778ad375d5bc213bc0a

Okay, here's the results:
https://gist.github.com/aurynn/b8cb57cbfdcca3ead7ea1f1371126c48

This was tested on straight S3.

Looks like, setting the bucket and file to public makes it publicly readable.

The IAM policy restricting reads on one object override the public ACL.

Setting a private ACL on the object overrides the public ACL.