IAM policy in AWS is designed to help you manage user access to your AWS resources, and to enforce security and compliance requirements. IAM policies can:
Require users to authenticate before accessing AWS resources
Authorize users who have been authenticated to access AWS resources
Restrict user access to AWS resources based on the user’s role
Audit user access to AWS resources
IAM policies are stored in the IAM policy store, and can be applied to resources in the following ways:
For resources in the EC2, S3, and EBS systems: You can create IAM policies for users in your organization, and then apply those policies to EC2 instances, S3 buckets, or EBS volumes.
For resources in the RDS system: You can create IAM policies for users in your organization, and then apply those policies to RDS instances.
For resources in the Lambda system: You can create IAM policies for users in your organization, and then apply those policies to Lambda functions.
When you create an IAM policy, you can specify the following information:
The role or role type that the policy will apply to
The permissions that the policy will grant to users in that role
The conditions that must be met before the policy will grant access to a resource
You can also specify the following attributes for the policy:
A name for the policy
A description of the policy
A URL where you can get more information about the policy
When you create an IAM policy, you can also specify the following permissions for the policy:
Read: The policy will allow users in the role to read resources that the policy applies to
Write: The policy will allow users in the role to write resources that the policy applies to
Execute: The policy will allow users in the role to execute resources that the policy applies to
The following permissions are not supported:
Delete: The policy will not allow users in the role to delete resources that the policy applies to
List: The policy will not allow users in the role to list resources that the policy applies to
Modify: The policy will not allow users in the role to modify resources that the policy applies to
Create tags: The policy will allow users in the role to create tags for resources that the policy applies to
If you want to apply a policy to a resource in the EC2, S3, or EBS systems, you first need to create an instance of the resource type that you want to control. For example, if you want to apply a policy to an EC2 instance, you first need to create an EC2 instance.
If you want to apply a policy to a resource in the RDS system, you first need to create an instance of the resource type that you want to control. For example, if you want to apply a policy to an RDS instance, you first need to create an RDS instance.
If you want to apply a policy to a resource in the Lambda system.
