AWS IAM Policies¶

Policy = Permission Document (JSON)
Attached to → IAM User / Group / Role / AWS Resource

{
  "Version": "2012-10-17",
  "Id": "optional-policy-id",
  "Statement": [
    {
      "Sid": "AllowS3ReadForReports",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::123456789012:role/ReportRole" },
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::reports-bucket",
        "arn:aws:s3:::reports-bucket/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "us-east-1"
        }
      }
    }
  ]
}

"Action": "s3:*"             ← all S3 actions
"Action": "s3:Get*"          ← all S3 GET actions
"Action": "*"                ← all actions on all services (admin)

"Resource": "*"              ← all resources
"Resource": "arn:aws:s3:::my-bucket/*"  ← all objects in bucket
"Resource": "arn:aws:s3:::my-bucket"    ← the bucket itself (not objects)

Created and maintained by AWS
Namespace: starts with "arn:aws:iam::aws:policy/..."
           Note: no account ID in ARN (AWS-owned)

Examples:
  AmazonS3FullAccess
  AmazonEC2ReadOnlyAccess
  AdministratorAccess
  PowerUserAccess
  ReadOnlyAccess

Properties:
  ✅ Versioned — AWS updates when new actions added
  ✅ Reusable — attach to unlimited users/roles/groups
  ✅ No management overhead
  ❌ Too broad — often violates least privilege
  ❌ Cannot customize

Created and maintained by YOU in your AWS account
Namespace: arn:aws:iam::123456789012:policy/MyCustomPolicy
                       ↑ your account ID

Properties:
  ✅ Fully customizable — exact permissions you need
  ✅ Versioned — up to 5 versions stored; set any as default
  ✅ Reusable — attach to unlimited users/roles/groups in same account
  ✅ Auditable — you control changes
  ❌ Requires maintenance when AWS adds new APIs

Embedded directly inside a specific user, group, or role
No separate existence — lives inside the entity
Deleted automatically when the entity is deleted

Properties:
  ✅ Tight coupling — policy guaranteed to go away with the entity
  ✅ Useful for unique one-off permissions
  ❌ Not reusable — cannot share with other entities
  ❌ Not visible in policy list — harder to audit
  ❌ No versioning
  ❌ Complicates automation at scale

When entity is deleted:
  Managed policy: remains in account ← exists independently
  Inline policy:  deleted with entity ← no independent existence

Controls: what the identity CAN DO to resources
Principal field: NOT included (the identity itself is the principal)

Types: AWS Managed, Customer Managed, or Inline
Attached to: User, Group, Role

Controls: who CAN ACCESS this resource
Principal field: REQUIRED (specifies who is allowed)

Examples:
  S3 Bucket Policy        ← most common
  SQS Queue Policy
  KMS Key Policy          ← controls who can use the key
  Lambda Resource Policy  ← controls who can invoke the function
  API Gateway Resource Policy

Cross-account access:
  Resource-based policy alone can grant cross-account access
  (no need for AssumeRole — just specify the other account's ARN as Principal)

"Condition": {
  "ConditionOperator": {
    "ConditionKey": "value"
  }
}

// Require MFA to delete S3 objects
{
  "Effect": "Deny",
  "Action": "s3:DeleteObject",
  "Resource": "*",
  "Condition": {
    "BoolIfExists": {
      "aws:MultiFactorAuthPresent": "false"
    }
  }
}

// Allow S3 access only from specific IP range
{
  "Effect": "Deny",
  "Action": "s3:*",
  "Resource": "*",
  "Condition": {
    "NotIpAddress": {
      "aws:SourceIp": ["203.0.113.0/24", "198.51.100.0/24"]
    }
  }
}

// Users can only access their own S3 "folder"
{
  "Effect": "Allow",
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::user-data/${aws:username}/*"
}

Evaluation order (strict precedence):

1. EXPLICIT DENY → Deny immediately (no exceptions, overrides everything)
      ↓ (if no explicit deny)
2. EXPLICIT ALLOW → Allow (from any applicable policy)
      ↓ (if no explicit allow)
3. IMPLICIT DENY → Deny by default (nothing was allowed)

For a request from an IAM user in Account A to a resource in Account A:
  ALLOW if:
    → At least one identity-based policy allows the action
    → AND resource-based policy doesn't deny
    → AND no explicit deny anywhere

For cross-account: user in Account B to resource in Account A:
  ALLOW if:
    → Identity-based policy in Account B allows the action
    → AND resource-based policy in Account A allows Account B principal
    → AND no explicit deny in either account

For a role session with a Permission Boundary:
  ALLOW only if:
    → Identity policy allows
    → AND Permission Boundary allows (intersection)
    → AND SCPs allow (if Organizations is used)

Request arrives
     │
     ▼
Explicit DENY in any policy? ──Yes──→ DENY ❌
     │ No
     ▼
Explicit ALLOW in applicable policy? ──No──→ DENY ❌ (implicit)
     │ Yes
     ▼
Permission Boundary allows? (if set) ──No──→ DENY ❌
     │ Yes
     ▼
SCP allows? (if Organizations) ──No──→ DENY ❌
     │ Yes
     ▼
     ALLOW ✅

Organization Root
  └── OU: Development
       └── OU: Engineering
            └── Account: 123456789012 (ibtisam's account)

SCP on Engineering OU: Deny all actions outside us-east-1, eu-west-1

→ Even if an IAM admin in account 123456789012 has AdministratorAccess,
  they CANNOT create resources in ap-southeast-1 — SCP blocks it

Root user is ALSO subject to SCPs (only time root user can be restricted)

✅ Good: S3 access scoped to a specific bucket
  "Resource": "arn:aws:s3:::my-app-data/*"

❌ Bad: Wildcard resource for write access
  "Action": "s3:PutObject",
  "Resource": "*"

✅ Good: Separate Allow from Deny in different statements
  Statement 1: Allow read on specific bucket
  Statement 2: Deny delete actions (even on allowed bucket)

✅ Good: Use conditions to scope by tag
  Allow EC2:* only if ec2:ResourceTag/Environment = "dev"
  → Developers cannot touch production instances

✅ Good: DenyDeleteOnProduction
  "Effect": "Deny",
  "Action": ["ec2:TerminateInstances", "rds:DeleteDBInstance"],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "aws:ResourceTag/Environment": "production"
    }
  }