IAM policy JSON and how AWS decides

Why read policy JSON?

The console can build policies with clicks, but in real jobs you review policies in code reviews, debug "Access Denied" errors and write least-privilege rules. All of that means reading the JSON. The good news: there are only a handful of parts.

The parts of a policy

"2012-10-17" is the current version of the policy language, not a date you should update. Older policies with "2008-10-17" lack features such as policy variables.

ARNs: names for resources

An ARN (Amazon Resource Name) uniquely names a resource. Its format is arn:partition:service:region:account-id:resource. The partition is aws for normal regions. Some parts are empty for global services: S3 bucket names are globally unique, so an S3 ARN has no region or account, and IAM is global, so its ARNs have no region.

arn:aws:s3:::college-results                    a bucket
arn:aws:s3:::college-results/*                  every object in that bucket
arn:aws:iam::123456789012:user/asha             an IAM user (no region)
arn:aws:ec2:ap-south-1:123456789012:instance/i-0abc1234def567890
arn:aws:dynamodb:ap-south-1:123456789012:table/Orders

Example 1: read one bucket

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListTheBucket",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::college-results"
    },
    {
      "Sid": "ReadTheFiles",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::college-results/*"
    }
  ]
}

Example 2: EC2 only in Indian regions

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Ec2InIndiaOnly",
      "Effect": "Allow",
      "Action": "ec2:*",
      "Resource": "*",
      "Condition": {
        "StringEquals": { "aws:RequestedRegion": ["ap-south-1", "ap-south-2"] }
      }
    }
  ]
}

Example 3: no deleting without MFA

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyDeletesWithoutMFA",
      "Effect": "Deny",
      "Action": ["ec2:TerminateInstances", "s3:DeleteBucket"],
      "Resource": "*",
      "Condition": {
        "BoolIfExists": { "aws:MultiFactorAuthPresent": "false" }
      }
    }
  ]
}

Another common condition limits requests to an office network: "Condition": { "IpAddress": { "aws:SourceIp": "203.0.113.0/24" } }. The /24 is CIDR notation: the first 24 bits are fixed, so it covers 203.0.113.0 to 203.0.113.255.

How AWS evaluates a request (simplified)

1. By default every request is denied. This is the implicit deny.
2. AWS gathers every policy that applies: the identity's policies and the resource's policy.
3. If any matching statement has Effect Deny, the answer is deny. An explicit deny always wins.
4. Otherwise, if any matching statement has Effect Allow, the answer is allow.
5. Otherwise the implicit deny stands.

A statement "matches" when the action matches its Action, the resource matches its Resource, and all its Conditions are true. In bigger setups there are extra layers: service control policies (SCPs) in AWS Organizations and permissions boundaries set the maximum an identity can ever get. An action must be allowed by those too. You will write a small version of this engine in the tasks.