AWS Security Learning Center
Practical, tested guides to writing AWS access policies: how IAM evaluates them, how to scope them, and how to verify them before they reach production.
Every policy shown in these guides is checked automatically for structure and placeholder identifiers, and each guide links to the official AWS documentation it is based on. Ready-to-adapt policies are in the policy example library; how the content is written and corrected is described in the methodology.
Foundations
- Designing least-privilege IAM policiesStart from the task, not the service: inventory the API calls, scope every action to concrete ARNs, add conditions where the request context allows, and use access data to remove what is never used.Updated
- Identity-based vs. resource-based policiesIdentity policies attach to who is acting; resource-based policies attach to what is being accessed and name a Principal. Within one account either can grant access; across accounts, both sides must.Updated
Amazon S3
- S3 bucket policy security best practicesKeep Block Public Access on, deny non-TLS requests, scope Principals to specific roles, use conditions for service principals, and remember a bucket has exactly one policy.Updated
- Cross-account S3 access with IAM roles and bucket policiesCross-account access needs an Allow on both sides. Compare granting a remote role in the bucket policy with having the remote workload assume a role in the bucket's account, and verify each with the CLI.Updated
AWS Organizations
- AWS service control policies: practical examplesSCPs set the maximum permissions for member accounts but never grant anything. Prefer deny-list guardrails, exempt global services where needed, and roll out through a test OU.Updated
- Permissions boundaries vs. SCPsBoth cap permissions without granting any. SCPs apply to whole accounts and are managed centrally; boundaries apply to individual users or roles and make delegated IAM administration safe.Updated
Conditions & evaluation
- IAM condition keys, with real examplesConditions turn a broad grant into a precise one. Learn the operators, the …IfExists and ForAnyValue/ForAllValues qualifiers, and the keys used most in production policies.Updated
- How AWS evaluates policies (and why explicit deny wins)Every request starts as an implicit deny; one explicit deny anywhere ends evaluation. Walk through the evaluation chain and the cross-account rule that both accounts must allow.Updated
Validation & operations
- Validating policies with IAM Access AnalyzerPolicy validation catches grammar errors and risky patterns for free; custom policy checks answer specific questions ("does this grant new access?") and are billed per check.Updated
- Common IAM security misconfigurations and how to fix themA field guide to the mistakes that turn into incidents, each with the risky pattern, why it is dangerous, and the corrected policy.Updated