AWS IAM Policies Basics

1. Introduction

AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS services and resources. IAM policies are a fundamental aspect of AWS security, allowing you to define permissions for users, groups, and roles.

2. Key Concepts

Key Definitions

Policy: A document that defines permissions for AWS resources.
Principal: An entity (user, role, or service) that can make a request for actions on AWS resources.
Action: The specific action that is allowed or denied (e.g., s3:PutObject).
Resource: The specific AWS resource that the action applies to (e.g., an S3 bucket).
Effect: Indicates whether the policy allows or denies access (Allow or Deny).

3. Policy Structure

IAM policies are written in JSON format. A policy consists of one or more statements. Each statement includes the Effect, Action, and Resource fields.

Example Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::my-bucket/*"
        }
    ]
}

4. Creating Policies

To create an IAM policy, follow these steps:

Sign in to the AWS Management Console.
Navigate to the IAM dashboard.
Select "Policies" from the sidebar.
Click on "Create policy".
Choose the "JSON" tab to input your policy.
Review and create the policy.

5. Best Practices

Tip: Always follow the principle of least privilege. Grant only the permissions necessary for users to perform their jobs.

Regularly review and audit IAM policies.
Use IAM roles instead of IAM users for applications running on AWS services.
Implement MFA (Multi-Factor Authentication) for sensitive accounts.

6. FAQ

What is the maximum size of an IAM policy?

The maximum size of a single IAM policy is 6,144 characters.

Can I attach multiple policies to a user?

Yes, you can attach multiple policies to a user, group, or role.

What happens if a policy denies access?

If a policy explicitly denies access, it overrides any allow permissions granted by other policies.