Policies and Permissions

A policy is an object in AWS that, when associated with an identity or resource, defines their permissions. AWS evaluates these policies when a principal entity (user or role) makes a request. Permissions in the policies determine whether the request is allowed or denied. Most policies are stored in AWS as JSON documents. AWS supports six types of policies: identity-based policies, resource-based policies, permissions boundaries, Organizations SCPs, ACLs, and session policies.

IAM policies define permissions for an action regardless of the method that you use to perform the operation. For example, if a policy allows the GetUser action, then a user with that policy can get user information from the AWS Management Console, the AWS CLI, or the AWS API. When you create an IAM user, you can choose to allow console or programmatic access.

Policy Types

Identity-Based Policies: They grant permissions to IAM identities like users, groups to which users belong, or roles.

Resource-Based Policies: The most common examples of resource-based policies are Amazon S3 bucket policies and IAM role trust policies. Resource-based policies grant permissions to a principal entity that is specified in the policy.

Permissions boundaries: This policy defines the maximum permissions that the identity-based policies can grant to an entity, but does not grant permissions.

Organizations SCPs: They define the maximum permissions for account members of an organization or organizational unit (OU).

Access control lists(ACLs): Use ACL's to control which principals in other accounts can access the resource to which the ACL is attached. They are the only policy type that does not use the JSON policy document structure. ACLs are cross-account permissions policies that grant permissions to the specified principal entity. ACLs cannot grant permissions to entities within the same account.

Session Policies: Session policies limit the permissions that the role or user's identity-based policies grant to the session. Session policies limit permissions for a created session, but do not grant permissions.

Policies and the Root User: The AWS account root user is affected by some policy types but not others. You cannot attach identity-based policies to the root user, and you cannot set the permissions boundary for the root user. However, you can specify the root user as the principal in a resource-based policy or an ACL. As a member of an account, the root user is affected by any SCPs for the account.

Recommended Readings For More Information :

Policies and Permissions: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html