aws-iam-patterns

AWS IAM Patterns

Secure IAM policy patterns, least-privilege templates, and the policy evaluation logic that governs all AWS access control.

Knowledge Base

IAM Policy Evaluation Logic

This is the most important concept in AWS security. Every API call is evaluated as follows:

1. Explicit Deny -- If ANY policy says Deny, the action is denied. Period. No override.
2. Organizations SCP -- If no SCP allows it, denied (SCPs are allowlists for member accounts).
3. Resource-based policy -- If a resource policy grants access, it can allow cross-account access without an identity policy (except for IAM roles in the same account).
4. Identity-based policy -- The policies attached to the user/role/group.
5. Permissions boundary -- If set, the effective permissions are the INTERSECTION of the identity policy and the boundary.
6. Session policy -- For assumed roles or federated users, further restricts to the intersection.
7. Implicit Deny -- If nothing explicitly allows it, denied.

Understanding this chain is what separates a secure AWS environment from a breached one.

Policy Types and When to Use Each

Policy Type	Attached To	Use Case
Identity-based (managed)	Users, roles, groups	Standard permissions for principals
Identity-based (inline)	Single user/role/group	Exception permissions that should not be reusable
Resource-based	S3 buckets, KMS keys, SQS queues, Lambda, etc.	Cross-account access, service principal access
Permissions boundary	Users, roles	Delegation -- let developers create roles within a boundary
SCP	Organization OU/account	Guardrails -- prevent entire categories of actions
Session policy	AssumeRole, GetFederationToken	Further restrict a specific session

Patterns

Pattern 1: Least-Privilege Role for a Lambda Function

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadSpecificDynamoDBTable",
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:Query",
        "dynamodb:BatchGetItem"
      ],
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/orders"
    },
    {
      "Sid": "WriteToSpecificS3Prefix",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::reports-bucket/lambda-output/*"
    },
    {
      "Sid": "AllowLogging",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/my-function:*"
    }
  ]
}