AWS Identity and Access Management (IAM) controls access to AWS resources through identities, policies, actions, resources, and contextual conditions. It is especially useful when authorization must follow enterprise identity attributes and AWS resource metadata. section 8.4 section 8.4.3
IAM policies use JSON statements to allow or deny AWS API operations. Principals may be users, roles, or federated identities; resources use Amazon Resource Names (ARNs); conditions compare request context, service attributes, and tags. section 8.4.3
Confidential document access
A corporate directory synchronizes department attributes through IAM Identity Center, placing them on authenticated principals as tags. A Lambda function tags uploaded S3 objects with the owner's department and a confidential marker. An IAM policy permits s3:GetObject only when the requester’s department matches the object owner’s department and the confidential tag is true. section 8.4.2
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::acme-docs/*",
"Condition": {
"StringEquals": {
"aws:PrincipalTag/department":
"${s3:ExistingObjectTag/owner-department}"},
"StringEqualsIfExists": {
"s3:ExistingObjectTag/confidential": "true"
}
}
}
]
}
Shows the complete IAM policy pattern, including the S3 resource, read action, principal-to-object tag comparison, and confidential-object condition. section 8.4.2
IAM combines several authorization mechanisms:
- Identity-based policies attach permissions to principals, while resource-based policies grant permissions directly on AWS resources. section 8.4.3
- Condition keys evaluate global context such as time or source IP, service-specific context, and principal or resource tags. section 8.4.3
- IAM provides fine-grained, mature, and globally scalable authorization, but its model and policies are limited to AWS. section 8.5.4
