# IAM Permission Boundaries

* AWS supports **permissions boundaries for IAM entities (users or roles)**.<br>
* A permissions boundary is an **advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity**.<br>
* An entity's permissions boundary **allows it to perform only the actions that are allowed by both its identity-based policies and its permissions boundaries**.<br>
* When you use a policy to set the permissions boundary for a user, it **limits the user's permissions but does not provide permissions on its own**.<br>
* &#x20;**Resource-based policies:**

![](https://40640462-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MQ39nPAiP6LTprAFu1T%2F-MSZZ0CD9HNPOWcT8Gk3%2F-MSk8_IJ_knkT0r2Lpw4%2Fimage.png?alt=media\&token=65f9bcf4-a412-4215-9fd7-ab43e07d80c5)

* **Organizations SCPs** - **SCPs are applied to an entire AWS account**. They **limit permissions for every request made by a principal within the account**. **An IAM entity (user or role) can make a request that is affected by an SCP, a permissions boundary, and an identity-based policy**. An **explicit deny in any of these policies overrides the allow**:

![](https://40640462-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MQ39nPAiP6LTprAFu1T%2F-MSZZ0CD9HNPOWcT8Gk3%2F-MSk8E16TvUIYplBpNLt%2Fimage.png?alt=media\&token=935cf4c6-fd37-4986-bcc7-8a01e5ac76ee)
