IAM Policy

An IAM Policy is a JSON document that defines permissions in AWS. It specifies which Actions (e.g., s3:GetObject) are Allowed or Denied on which Resources (e.g., arn:aws:s3:::my-bucket/*), optionally with Conditions (e.g., only from a specific IP range).

Policy Types

• Identity-based policies: attached to IAM users, groups, or roles
• Resource-based policies: attached to resources (S3 bucket policies, SQS queue policies)
• Permission boundaries: set the maximum permissions an identity can have
• Service Control Policies (SCPs): organization-wide guardrails that restrict what member accounts can do
• Session policies: limit permissions for a specific session when assuming a role

Policy Evaluation Logic

AWS first checks all policies for an explicit Deny (which always wins). Then it verifies SCPs allow the action. The effective permissions for an identity are the intersection of identity-based policies, permission boundaries, and session policies. Resource-based policies can independently grant same-account access. If nothing explicitly allows an action, it is implicitly denied.

Security Best Practices

• Never use "Action": "*" or "Resource": "*" - always scope to specific actions and resources
• Use conditions to add guardrails (e.g., aws:RequestedRegion, aws:PrincipalOrgID)
• Use IAM Access Analyzer to identify unused permissions and generate least-privilege policies