tl;dr: A small overview of AWS permissions and policies
This is some notes or a cheatsheet I wrote while reading about AWS permissions and policies. It is a collection of information from the AWS documentation and other sources.
Table of Contents Policy Types of Policies Evaluation of identity-based policies Identity-based and resource-based policies Cross-account access using IAM roles Service Control Policies (scps) How AWS evaluates policies Policy Consists of: Version: policy language version Id: optional identifier for policy (optional) Statement: One or more individual statements (required) Statements consists of: Sid: Identifier for the statement (optional) Effect: allow or deny Principal: account/user/role/service to which this policy applies Action: list of actions this policy allows/denies Resource: list of resources to which the actions applies Condition: conditions for when this policy is in effect (optional) { "Version": "2012-10-17", "Id": "ExamplePolicyWithCondition", "Statement": [ { "Sid": "AllowS3AccessWithCondition", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:role/MyExampleRole" }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*", "Condition": { "IpAddress": { "aws:SourceIp": "203.0.113.0/24" } } } ] } Types of Policies Organizations resource control policies (RCPs): used to set permissions on AWS Organizations resources Organizations service control policies (SCPs): used to set permission guardrails across multiple AWS accounts Permissions boundaries: used to set the maximum permissions that an identity-based policy can grant to an IAM entity Resource-based policies: attached to resources (S3 bucket, SNS topic, SQS queue) Identity-based policies: attached to IAM identities (users, groups, roles) Session policies: passed when an IAM role is assumed Evaluation of identity-based policies: With resource-based policies: The resulting permissions are the union of the permissions. So only one, the other or both are needed for the action to be allowed. With permissions boundaries: The resulting permissions are the intersection of the permissions. So both the identity-based policy and the permissions boundaries must allow the action for the action to be allowed. With SCPs or RCPs: The resulting permissions are the intersection of the permissions. So both the identity-based policy and the SCPs or RCPs must allow the action for the action to be allowed. The only exceptions are principals that are part of the management account, which are not affected by SCPs or RCPs. Identity-based and resource-based policies In some cases resource-based policies are required as well as identity-based policies.
...
