Understanding IAM Policies

  • A policy is an object in AWS that, when associated with an identity or resource, defines their permissions.

Example IAM Policies

  • This example shows how you might create an IAM policy that denies access to any actions outside the Regions specified using aws:RequestedRegion:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyAllOutsideRequestedRegions",
            "Effect": "Deny",
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "aws:RequestedRegion": [
                        "eu-central-1",
                        "eu-west-1",
                        "eu-west-2",
                        "eu-west-3"
                    ]
                }
            }
        }
    ]
}

  • This example shows how you might create an IAM policy that allows starting or stopping instances with the tag key–value pair Project = DataAnalytics:

  • This example shows how you might create an IAM policy that allows read and write access to a specific DynamoDB table. The policy also allows writing log files to CloudWatch Logs:

PreviousIAM Policy Evaluation LogicNextIAM Tutorial: Delegate access across AWS accounts using IAM roles

Last updated

Was this helpful?