All 7 IAM questions
More in IAM
What is AWS IAM and what fundamental problem does it solve for controlling access to AWS resources? What is the difference between an IAM user, an IAM group, and an IAM role? What is the principle of least privilege in IAM, and what practical strategies help apply it effectively? How does IAM policy evaluation logic determine the final outcome when a user has multiple applicable policies, including identity based and resource based policies? How does IAM support federated identity and single sign on integration with external identity providers like corporate Active Directory or a SAML based provider? How should an organization design a comprehensive IAM governance strategy combining permission boundaries, service control policies, and regular access reviews across a growing organization?
Advertisement
AWS › IAM

How do IAM policies use the combination of effect, action, resource, and condition elements to precisely define permissions?

Intermediate

Answer

An IAM policy is a JSON document specifying an effect, either Allow or Deny, the specific actions being permitted or denied, such as s3:GetObject, the specific resources those actions apply to, identified by their Amazon Resource Name, and optionally a condition that further restricts when the policy applies, such as only allowing access from a specific IP address range, together forming a precise, explicit statement of exactly what is and is not permitted.
{
  "Effect": "Allow",
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::my-bucket/*",
  "Condition": {"IpAddress": {"aws:SourceIp": "203.0.113.0/24"}}
}
Real-world example A company writes an IAM policy granting a specific role read only access to objects in a particular S3 bucket, but only when the request originates from their corporate office's known IP address range, adding an extra layer of restriction beyond just the basic permission itself.

Common follow-ups: What happens when an explicit Deny and an Allow both apply to the same request?;What are some other commonly used condition keys besides source IP address?

S3 & Storage;VPC & Networking
All 7 IAM questions