IAM Permissions

An IAM Principal can have multiple policies attached to it. These policies determine what the principal is authorized to do in your account.

Each policy consists of one or more statements that consist of:

1. An optional statement Identifier (Sid (opens in new tab))
2. Action - a list of things the policy allows or denies
3. Resources - the ARNs of resources the statement applies to
4. Effect - either Allow or Deny
5. Condition - optional conditions that must be satisfied for the policy to grant permission

AWS provides many AWS Managed Policies (opens in new tab) that contain a list of actions that usually map to a specific job function. However, AWS customers can also create custom policies that are more fine-grained. For example, you can craft an IAM policy that only allows someone to read from one specific S3 Bucket or to start or stop, but not terminate, a specific EC2 instance.

Customer policies can be either Customer Managed Policies (opens in new tab) or Inline Policies (opens in new tab) directly attached to a specific principal and cannot be shared. Inline policies are best to ensure a direct relationship between a principal and the policies granted. In contrast, managed policies can reuse the policy across multiple principals.

The most powerful AWS managed policy is the AdministratorAccess policy shown below.

           Patton:~ chris$ aws iam get-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess
{
    "Policy": {
        "PolicyName": "AdministratorAccess",
        "PolicyId": "ANPAIWMBCKSKIEE64ZLYK",
        "Arn": "arn:aws:iam::aws:policy/AdministratorAccess",
        "Path": "/",
        "DefaultVersionId": "v1",
        "AttachmentCount": 3,
        "PermissionsBoundaryUsageCount": 0,
        "IsAttachable": true,
        "Description": "Provides full access to AWS services and resources.",
        "CreateDate": "2015-02-06T18:39:46+00:00",
        "UpdateDate": "2015-02-06T18:39:46+00:00",
        "Tags": []
    }
}
Patton:~ chris$ aws iam get-policy-version --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --version-id v1
{
    "PolicyVersion": {
        "Document": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Action": "*",
                    "Resource": "*"
                }
            ]
        },
        "VersionId": "v1",
        "IsDefaultVersion": true,
        "CreateDate": "2015-02-06T18:39:46+00:00"
    }
}

        

Looking at the policy statement, we can see it allows all actions on all resources.

"Statement": [
    {
        "Effect": "Allow",
        "Action": "*",
        "Resource": "*"
    }
]

In the remaining tasks in this room, we will go through all the different elements of an IAM Statement in more depth.

There is another managed policy called ReadOnlyAccess. Using the commands above, go look at the permissions granted to the ReadOnlyAccess user. At the time of this writing, the VersionId was v83. Use the AWS CLI (as shown above) to answer the following question: