1The Anatomy of a Policy
IAM policies are JSON documents that explicitly list permissions. The acronym PARC (Principal, Action, Resource, Condition) is helpful. Note that identity-based policies don't explicitly require the 'Principal' element because the principal is the user or role it's attached to.
2The Evaluation Logic
When AWS evaluates a request, it starts with a default Deny. It then checks all policies. If there is an explicit Deny, the request is denied immediately. If there is no explicit Deny, but an Allow exists, the request is allowed.
3Step-by-Step Breakdown
IAM Users. An IAM user represents an individual or application that interacts with AWS.
IAM Groups. Groups are collections of users. Assigning policies to groups is a best practice for scalability.
Inline vs Managed Policies. Managed policies can be attached to multiple entities. Inline policies are strictly attached to a single entity.
JSON Structure. Policies are written in JSON format. They consist of a Version and an array of Statements.
The Statement Block. Each statement defines a specific rule using Effect, Action, Resource, and sometimes Condition.
Policy Check. What element in an IAM JSON policy determines whether the action is permitted or denied?
- →Action
- →Effect
- →Resource
Explicit Deny. An explicit Deny in any policy always overrides any Allow.
Conditions. Conditions add fine-grained control, like restricting access based on IP address or time of day.
Policy Simulator. AWS provides a Policy Simulator tool to test your JSON policies before applying them.
Completion. You now understand how to define strict permissions using JSON.
