IAM Policies and Permissions in AWS

Access in AWS is controlled by creating policies and assigning them to IAM identities such as users, user groups, roles, or directly to AWS resources. This blog post will guide you through the basics of IAM policies and permissions, including policy types, document structure, and a practical demo on how to create and use policies in AWS.

What are IAM Policies and Permissions?

IAM policies are objects in AWS that define the permissions for an identity or resource. When an IAM principal (user or role) makes a request, AWS evaluates these policies to determine whether the request should be allowed or denied. The main purpose of policies is to control access to AWS services and resources, ensuring security and compliance by enforcing the principle of least privilege.

Types of IAM Policies

AWS supports several types of policies:

1. Identity-Based Policies: These policies grant permissions to an identity (users, groups, or roles). Managed and inline policies can be attached to IAM identities.
2. Resource-Based Policies: These policies are attached directly to resources like Amazon S3 buckets or IAM role trust policies. They grant permissions to specified principals, which can be in the same AWS account or different accounts.
3. Permission Boundaries: These policies set the maximum permissions that identity-based policies can grant to an entity but do not grant permissions themselves.
4. Service Control Policies (SCPs): Used within AWS Organizations, SCPs determine the maximum permissions for accounts that are members of an organization or organizational unit.
5. Access Control Lists (ACLs): ACLs are cross-account permission policies that grant permissions to specified principals. ACLs do not use JSON policy document structures.
6. Session Policies: These policies limit permissions granted by the identity-based policies for the duration of a session. They are used with services like AWS IAM Identity Center to control session tokens’ expiry.

🌟 Master AWS Fundamentals! 🌟

Ready to dive into the world of cloud computing? Check out this comprehensive course on Coursera: AWS Fundamentals Specialization

This certification course covers everything you need to know about Amazon Web Services, from the basics to advanced concepts, making it perfect for both beginners and those looking to enhance their cloud skills. Enroll now and elevate your career with in-demand AWS expertise! 📚🚀

Identity-Based Policy Categories

Identity-based policies can be further categorized into:

• Managed Policies: Standalone policies that can be attached to multiple users, groups, and roles in your AWS account. They are either AWS-managed or customer-managed.
• Inline Policies: These policies are directly attached to a single user, group, or role, maintaining a one-to-one relationship. They are deleted if the associated identity is deleted.

JSON Policy Document Structure

IAM policies are represented as JSON objects in AWS, including optional policy-wide information at the top and one or more individual statements. Here’s a breakdown of common elements in a policy document:

• Version: Specifies the version of the policy language. The most recent version is “2012-10-17”.
• Statement: An array of statement objects. Each statement includes:
  • SID: A unique identifier for the statement.
  • Effect: Specifies whether the statement allows or denies access.
  • Action: Defines the specific actions that are allowed or denied.
  • Resource: Specifies the resources that the actions apply to.
  • Condition: Optional conditions that must be met for the statement to apply.
  • Principal: Required in resource-based policies to specify the account, user, or role to which the policy applies.

Here’s an example policy that grants read-only access to an S3 bucket from a specific IP range:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3ReadOnlyAccess",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        }
      }
    }
  ]
}

Practical Demo: Creating and Using Policies in AWS

Let’s go through a demo of creating a customer-managed policy and using it in an EC2 instance. We will also going to attach policies to an IAM role. If you would like to learn more about IAM roles, please check out this article.

Through this demo, you can see how policies control access to AWS resources and how to effectively use them to ensure security in your AWS environment.

Conclusion

Understanding IAM policies and permissions is crucial for managing access in AWS. By defining policies correctly, you can ensure that your AWS resources are secure and that users only have the necessary permissions they need to perform their tasks. Whether you are using managed or inline policies, following best practices for least privilege is key to maintaining a secure AWS environment.