If you have worked in AWS CLOUD, you must be knowing about IAM (Identity and Access Management) and the policy. IAM policies are also called Identity Based policy . This differs from Resource based policies as applied in S3.
There are many use-case when you apply policies and stuck in understanding of the order, the policy may be executing.
Examples :
- You want to give all permission except Billing and IAM.
- You want to allow only EC2 permissions for a IAM user and deny all
- What will be the allocation if you don’t give any permission
In a bigger picture, AWS IAM policy works in order of,
Implicitly Deny ALL >> Explicitly Allow >> Explicitly Deny
Detail logic of the execution flow as per AWS resource :https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html
Two Most handful resource in policy creation are
- JSON policy Generator UI : https://awspolicygen.s3.amazonaws.com/policygen.html
- Simulate your policy against iam users with different action without attaching them
https://awspolicygen.s3.amazonaws.com/policygen.html
Example 1: Policy to ” Allow ALL except Billing and IAM permission “
{
"Version":"2012-10-17",
"Statement":[
{
"Effect":"Allow",
"Action":"*",
"Resource":"*"
},
{
"Effect":"Deny",
"Action":"aws-portal:*",
"Resource":"*"
},
{
"Effect":"Deny",
"Action":"iam:*",
"Resource":"*"
}
]
}The most common usage in aws beginning is to assign a policy to system engineer to use AWS service but should not able to access billing and Identity Management .
for more : https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html
