Understanding IAM policies
An IAM policy is a JSON-formatted document that defines which action a user, group, or role can perform on AWS resources. When users or roles make a request, the AWS policy engine evaluates these policies and, depending on the permission defined in the policy request, is either allowed or denied. Once again, I want to re-emphasize the point that IAM policies are used for authorization. For authentication purposes, we are going to use IAM users.
Note
By default, all requests are implicitly denied, and IAM identities (user, group, or role) have no permissions or policies attached by default.
AWS supports four types of policies:
- Identity-based policies: To grant permission to any identity, which can be users, groups, or roles, we can use identity-based policies.
- Resource-based policies: This policy is mostly used with resources, such as an S3 bucket or KMS keys to grant permissions to a principal.
- Permissions boundaries: Permissions...