Permissions let you specify access to AWS resources. Permissions are granted to IAM entities (users, groups, and roles) and by default these entities start with no permissions. In other words, IAM entities can do nothing in AWS until you grant them your desired permissions. To give entities permissions, you can attach a policy that specifies the type of access, the actions that can be performed, and the resources on which the actions can be performed. In addition, you can specify any conditions that must be set for access to be allowed or denied.
Adobe Flash Player or a modern browser is required to view videos on this site.
- Move Over JSON – Policy Summaries Make Understanding IAM Policies Easier
- How to Assign Permissions Using New AWS Managed Policies for Job Functions
- How to Enable MFA Protection on Your AWS API Calls
- IAM Service Last Accessed Data Now Available for the Asia Pacific (Mumbai) Region
- AWS IAM Service Last Accessed Data Now Available for South America (Sao Paulo) and Asia Pacific (Seoul) Regions
- Now Available: Get Even More Details from Service Last Accessed Data
To assign permissions to a user, group, role, or resource, you create a policy that lets you specify:
- Actions – Which AWS actions you allow. For example, you might allow a user to call the Amazon S3 ListBucket action. Any actions that you don't explicitly allow are denied.
- Resources – Which AWS resources you allow the action on. For example, what Amazon S3 buckets will you allow the user to perform the ListBucket action on? Users cannot access any resources that you do not explicitly grant permissions to.
- Effect – Whether to allow or deny access. Because access is denied by default, you typically write policies where the effect is to allow.
- Conditions – Which conditions must be present for the policy to take effect. For example, you might allow access only to the specific S3 buckets if the user is connecting from a specific IP range or has used multi-factor authentication at login.
Policies are created using JSON. A policy consists of one or more statements, each of which describes one set of permissions. To learn more about the policy language, see AWS IAM Policy Reference. Here's an example of a simple policy:
If you use the AWS Management Console to manage permissions, you will see your JSON policy documents in policy summaries. A policy summary lists the access level, resources, and conditions for each service defined in a policy (see the following screenshot for an example). The access level (View, Read, Write, or Permissions management) is defined by actions granted for each service in the policy.