Permissions let you specify access to AWS resources. Permissions are granted to IAM entities (users, groups, and roles) and by default these entities start with no permissions. In other words, IAM entities can do nothing in AWS until you grant them your desired permissions. To give entities permissions, you can attach a policy that specifies the type of access, the actions that can be performed, and the resources on which the actions can be performed. In addition, you can specify any conditions that must be set for access to be allowed or denied.
To assign permissions to a user, group, role, or resource, you create a policy that lets you specify:
- Actions – Which AWS service actions you allow. For example, you might allow a user to call the Amazon S3 ListBucket action. Any actions that you don't explicitly allow are denied.
- Resources – Which AWS resources you allow the action on. For example, what Amazon S3 buckets will you allow the user to perform the ListBucket action on? Users cannot access any resources that you do not explicitly grant permissions to.
- Effect – Whether to allow or deny access. Because access is denied by default, you typically write policies where the effect is to allow.
- Conditions – Which conditions must be present for the policy to take effect. For example, you might allow access only to the specific S3 buckets if the user is connecting from a specific IP range or has used multi-factor authentication at login.
You create policies by using either the visual editor or JSON. A policy consists of one or more statements, each of which describes one set of permissions. To learn more about the policy language, see IAM Policy Reference.
The visual editor guides you through granting permissions by using IAM policies without requiring you to write the policies in JSON (although you can still author and edit policies in JSON, if you prefer). The policy in the following screenshot was created with the visual editor. It grants five Amazon S3 List and Read actions to the S3 bucket and objects in SampleBucket if the prefix starts with MyPrefix.
If you use the AWS Management Console to manage permissions, you can view policy summaries. A policy summary lists the access level, resources, and conditions for each service defined in a policy (see the following screenshot for an example). To help you understand the permissions defined in a policy, each AWS service’s actions are categorized in four access levels: List, Read, Write, and Permissions management.