Resource-based access control attaches an authorization policy to a resource. The policy names permitted principals, actions, and sometimes conditions; the system evaluates it when access is requested. section 5.1 section 8.4.3
A shared folder illustrates the model: Alice may write, Bob may read, and Carol may be denied because she is not part of the permitted group. This works best when ownership and permissions are clear and relatively stable. section 5.1
Figure 5.1 An ACL attached to a shared resource. The ACL specifies which principals—such as Alice, Bob, and the Marketing group—are authorized to access the “Marketing Campaign Plans” folder and outlines the actions they are allowed to perform.
Use the ACL diagram to compare named principals, groups, and actions attached directly to one shared resource. section 5.1
Common forms show how the same idea scales from simple files to cloud services:
- Unix permissions provide a simplified ACL through three principal categories—owner, group, and others—and read, write, and execute actions. section 5.1
- AWS IAM resource-based policies grant permissions directly on AWS objects, alongside identity-based policies attached to principals. section 8.4.3 section 8.5.4
- IAM can combine resource identity, API actions, principal or resource tags, and context such as time or source IP for fine-grained decisions. section 8.4.3
A file permission decision
The listing -rwxr-xr-- 1 alice devs deploy.sh gives Alice read, write, and execute access; the devs group gets read and execute; everyone else gets read-only access. section 5.1
