AWS policy example library
15 worked examples for common AWS access problems. Each one starts from a real situation and gives the policies, how to deploy them, checks that change nothing in your account, the mistakes people make, and the limits of the approach.
Examples use AWS's documented placeholder values (account 111122223333, bucket amzn-s3-demo-bucket). Replace them, then test in your own account before use. Policy types matter; each example is labelled:
- IAM identity-based policy. Attached to an IAM user, group or role. Grants that identity permissions. Has no Principal element.
- Amazon S3 bucket policy. A resource-based policy attached to one bucket. Must name a Principal; resources must be the bucket or its objects.
- IAM role trust policy. The resource-based policy on a role that says who may assume it. Names a Principal; has no Resource element.
- Service control policy (SCP). An AWS Organizations guardrail on member accounts. Never grants permissions; has no Principal element.
Browse examples
Showing 15 of 15 examples
- Amazon S3 · Identity policyRead-only access to one S3 bucketLet a role list one bucket and download its objects, including SSE-KMS objects, and nothing else in S3.
- Amazon S3 · Identity policyLimit a team to its own prefix in a shared S3 bucketGive a team read, write and list access under teams/analytics/ in a shared bucket, with optional console navigation.
- IAM administration · Identity policyRequire MFA for sensitive actionsDeny selected destructive and credential-changing actions unless an IAM user's session used MFA, and test the condition without running them.
- Organizations (SCPs) · SCP + Trust policySCP: restrict member accounts to approved RegionsA Region-deny SCP with global-service exemptions and a break-glass role, plus the companion SCP that stops member accounts from creating or taking over that role.
- Data & logs · Identity policyRead, search and query one CloudWatch Logs log groupLet an on-call engineer search, tail and run Logs Insights queries on one application's log group, not every group in the account.
- Compute · Trust policy + Identity policyLambda execution role: trust and logging permissionsAn execution role that only the Lambda service can assume and that can write only to its own function's log group, with checks that change nothing.
- Data & logs · Identity policyRead and write items in one DynamoDB table and its indexesItem-level reads and writes on one DynamoDB table and its indexes without table administration, plus optional per-user partitions and stream reads.
- Cross-account access · Trust policy + Identity policyCross-account role access: trust and caller policiesLet one role in 444455556666 assume a role in 111122223333: the trust policy, the caller's sts:AssumeRole grant, and how to test each side.
- Cross-account access · Trust policyThird-party role access with an external IDA trust policy for a SaaS vendor: trust the vendor's documented role, require the external ID it issued you, and verify it from your own account.
- Amazon S3 · Bucket policyRequire HTTPS and keep an S3 bucket inside your organizationOne bucket policy with two baseline denies: no plain-HTTP requests, and no principals from outside your AWS organization.
- Amazon S3 · Bucket policyPrivate S3 bucket behind CloudFront (Origin Access Control)Bucket policy for CloudFront OAC: one distribution may read, the bucket stays private, plus SSE-KMS and OAI migration.
- Organizations (SCPs) · SCP + Trust policySCP security baseline for CloudTrail, GuardDuty, Config and S3Organization-level S3 Block Public Access plus an SCP that stops member accounts from weakening CloudTrail, GuardDuty, AWS Config or leaving the organization.
- Compute · Identity policyEC2 read-only inventory without exposing instance user dataAn explicit list of EC2 Describe actions for an inventory or CMDB tool, with the calls that return user data or console output explicitly denied.
- Compute · Identity policy + Trust policyEC2 ABAC: operate only your own team's instances by tagOne policy that lets each team start, stop, reboot and launch only instances tagged with its own Team value, with tag changes locked down.
- IAM administration · Identity policyDelegated IAM administration with a permissions boundaryLet a team create, change and delete /app/ roles only with the AppWorkloadBoundary boundary, never remove it, and pass those roles only to Lambda.
New to policy design? Start with the least-privilege guide or the Learning Center.