An IAM policy defines permissions for requests to AWS services. IAM checks the caller’s identity and whether an action is allowed; users and roles have no permissions by default. An identity policy grants permissions when attached to a user, group, or role. section 5.3.2
A policy is a JSON document containing one or more statements:
- Effect says Allow or Deny; Action names the permitted or denied API actions. If both effects apply to an action, Deny wins. section 5.3.3
- Resource identifies what the statement applies to. * is broad; an Amazon Resource Name (ARN) can identify a specific resource. Conditions can narrow a permission further. section 5.3.3 section 5.3.5
- Identity policies attach to identities. Resource policies attach to supported resources, such as S3 buckets, and use Principal to identify who may act. section 5.3.3
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "ec2:*",
"Resource": "*"
}, {
"Effect": "Deny", #1
"Action": "ec2:TerminateInstances", #2
"Resource": "*"
}]
}
This policy allows EC2 actions but explicitly denies terminating instances. The Deny still applies despite the broader Allow. section 5.3.3
For a person, attach an identity policy directly or use a group to manage shared permissions. Reusable managed policies may be maintained by AWS or by you. For an AWS workload, use a role rather than storing a user’s access keys on an EC2 instance. An EC2 role can, for example, allow StopInstances only when an instance has a specified tag; a Lambda role can allow CreateTags for its task. Grant only the actions and resources needed. section 5.3.3 section 5.3.4 section 5.3.5 section 6.3.4
IAM policies control RDS and ElastiCache configuration actions, not access inside a database or cache. Database and cache engines handle their own internal access; security groups control network access to cache nodes. section 10.4.1 section 11.3.1
