IAM Policies: The Complete Guide to AWS Security

IAM (Identity and Access Management) controls who can do what in AWS. It's tested heavily on ALL AWS certification exams. After reviewing 500+ IAM configurations, here's everything you need to know.

IAM Fundamentals

The 4 Core Components:

User → Who you are (person or application)
  ↓
Group → Collection of users
  ↓
Role → Temporary credentials for services
  ↓
Policy → Permissions document (JSON)

Policy Anatomy:

Components:

• Version: Always use "2012-10-17" (latest)
• Statement: Array of permission rules
• Effect: Allow or Deny
• Action: AWS service operations
• Resource: What the action applies to
• Condition: Optional restrictions

Policy Evaluation Logic

The Golden Rule:

Explicit DENY > Explicit ALLOW > Implicit DENY

1. Start with DENY (implicit)
2. Check for explicit DENY → If found, STOP (denied)
3. Check for explicit ALLOW → If found, ALLOW
4. If no ALLOW found → DENY (implicit)

Real Example:

Result: Can do ALL S3 actions EXCEPT DeleteBucket (deny wins).

Types of Policies

1. Identity-Based Policies

Attached to users, groups, or roles.

Managed Policy (AWS-provided):

Custom Inline Policy:

2. Resource-Based Policies

Attached to resources (S3 buckets, SQS queues, Lambda functions).

S3 Bucket Policy:

3. Permission Boundaries

Limits the maximum permissions a user/role can have.

Even if user has AdministratorAccess, they can only use S3, DynamoDB, and Lambda.

4. Service Control Policies (SCPs)

Organization-level policies that apply to ALL accounts.

Common IAM Patterns

Pattern 1: Least Privilege Access

❌ Bad (Too Broad):

✅ Good (Specific):

Pattern 2: Cross-Account Access

Account A (trusting) grants access to Account B (trusted).

Step 1: Create role in Account A

Step 2: User in Account B assumes role

Pattern 3: MFA Enforcement

Result: Can start instances anytime, but must use MFA to stop/terminate.

Pattern 4: Time-Based Access

Result: Access only valid during 2024.

Pattern 5: IP-Based Restrictions

Result: Deny all actions unless from office IP ranges.

IAM Roles Deep Dive

Service Roles

Allow AWS services to act on your behalf.

Lambda Execution Role:

EC2 Instance Role:

Security Best Practices

1. Never Use Root Account

❌ Bad:

✅ Good:

2. Rotate Access Keys Regularly

3. Use IAM Roles for EC2

❌ Bad (Hardcoded credentials in EC2):

✅ Good (IAM role):

4. Enable CloudTrail

Troubleshooting IAM Issues

Error: "Access Denied"

Step 1: Check identity-based policies

Step 2: Check resource-based policies

Step 3: Check permission boundaries

Step 4: Check SCPs (if using Organizations)

IAM Policy Simulator

Test policies before applying:

Exam Tips

SAA-C03 Key Points:

1. Roles > Users for applications

   • EC2, Lambda, ECS all use roles
   • Never hardcode credentials

2. Temporary credentials expire

   • STS (Security Token Service) issues temp creds
   • Default: 1 hour, max: 12 hours

3. Cross-account access uses roles

   • Trust policy defines WHO can assume
   • Permission policy defines WHAT they can do

4. MFA for sensitive operations

   • Require MFA for deletion, termination
   • Use condition: aws:MultiFactorAuthPresent

Common Exam Scenarios:

Q: EC2 needs to access S3. How? ✅ Create IAM role, attach S3 permissions, assign to EC2

Q: Enforce encryption for S3 uploads? ✅ Bucket policy with Deny condition checking encryption header

Q: User in Account A needs S3 access in Account B? ✅ Cross-account role with AssumeRole

Q: Prevent users from deleting CloudTrail logs? ✅ Deny policy for CloudTrail delete actions

Quick Reference

Policy Actions Cheat Sheet:

Condition Keys:

---

Practice IAM questions →