IAM Policies (JSON)
Policies are JSON documents that list which actions are allowed or denied on which resources.
{ "Effect": "Allow", "Action": "...", "Resource": "..." }Permissions in IAM are defined by policies written in JSON. Each policy contains one or more statements.
Anatomy of a statement
- Effect —
AlloworDeny. - Action — the API operations, e.g.
s3:GetObject. - Resource — the ARNs the actions apply to.
- Condition (optional) — extra rules, e.g. only from a certain IP.
Managed vs inline
AWS managed policies are pre-built by AWS (e.g. AmazonS3ReadOnlyAccess). Customer managed policies are your own reusable policies. Inline policies are embedded directly into a single user or role.
How access is evaluated
An explicit Deny always wins. If nothing explicitly allows an action, it is denied by default.
Example
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowReadOneBucket",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::my-app-assets",
"arn:aws:s3:::my-app-assets/*"
]
}
]
}When to use it
- A policy grants S3 read-only access to a specific bucket so a reporting service can download files but never upload or delete them.
- An IAM policy uses a condition key to allow EC2 actions only when the request originates from the corporate IP range.
- A developer attaches a customer-managed policy to a role to allow exactly the DynamoDB operations the application needs, nothing more.
More examples
Create S3 Read-Only Policy
An IAM policy that grants read-only access (GetObject and ListBucket) to a specific S3 bucket and its contents.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::my-reports-bucket",
"arn:aws:s3:::my-reports-bucket/*"
]
}
]
}Attach Managed Policy to Role
Creates a customer-managed policy from a JSON file and attaches it to a role, keeping permissions reusable and auditable.
# Create the policy from a file
aws iam create-policy \
--policy-name S3ReadOnlyReports \
--policy-document file://s3-read-policy.json
# Attach it to a role
aws iam attach-role-policy \
--role-name ReportingRole \
--policy-arn arn:aws:iam::123456789012:policy/S3ReadOnlyReportsDeny Policy with IP Condition
A deny policy that blocks all AWS actions unless the request comes from the specified corporate IP range.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": "*",
"Resource": "*",
"Condition": {
"NotIpAddress": {
"aws:SourceIp": ["203.0.113.0/24"]
}
}
}
]
}
Discussion