AWS IAM Policy Builder

An AWS IAM policy is a JSON document that defines permissions. It contains one or more statements, each specifying an Effect (Allow or Deny), a list of Actions (API calls like s3:GetObject), and Resources (ARNs the actions apply to). Policies are attached to IAM identities (users, groups, roles) or AWS resources. AWS evaluates all applicable policies at request time using a default-deny model.

Allow explicitly grants permission to perform actions on resources. Deny explicitly forbids actions, overriding any Allow statements from other policies. AWS evaluates all policies together: if any Deny matches, access is denied regardless of Allow statements. Use Deny to enforce guardrails that cannot be overridden by other policies, such as preventing deletion of critical resources or restricting to specific regions.

ARN (Amazon Resource Name) is a unique identifier for AWS resources. Format: arn:partition:service:region:account-id:resource. Examples: arn:aws:s3:::my-bucket/* (all objects in a bucket), arn:aws:lambda:us-east-1:123456789012:function:my-fn (specific Lambda), arn:aws:dynamodb:us-east-1:123456789012:table/Users (DynamoDB table). Use * as a wildcard for 'all resources', but prefer specific ARNs for least-privilege.

Least privilege means granting only the minimum permissions required for a task. Instead of s3:* on all resources, grant s3:GetObject and s3:PutObject on a specific bucket ARN. This limits blast radius if credentials are compromised. Start restrictive and add permissions as needed. Use IAM Access Analyzer to identify and remove unused permissions over time.

Conditions add context-based restrictions to policy statements. They use condition operators (StringEquals, IpAddress, DateLessThan, etc.) and condition keys (aws:RequestedRegion, aws:SourceIp, s3:prefix). For example, StringEquals with aws:RequestedRegion: us-east-1 restricts actions to that region only. Conditions are ANDed within a block and ORed between blocks of the same operator.

Identity-based policies are attached to IAM users, groups, or roles and define what that identity can do. Resource-based policies are attached directly to resources like S3 buckets, Lambda functions, or SQS queues and define who can access that resource. Both are evaluated for cross-account access. Resource-based policies are the only way to grant cross-account access without assuming a role.