Lesson 05 — IAM Policies

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 02 – Identity & Access Management (IAM)

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand IAM Policies.
Read IAM JSON policy documents.
Understand Actions, Resources and Effects.
Differentiate AWS Managed and Customer Managed Policies.
Design permissions using an Enterprise Permission Matrix.
Attach policies to Groups.
Apply the Principle of Least Privilege.

📚 Lesson Information

Estimated Time: 4 Hours

Difficulty: Beginner

Prerequisites: Lesson 04 – IAM Groups

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

Imagine CloudNova Technologies has 700 employees.

Everyone currently has:

AdministratorAccess

The CISO immediately says:

“This is our biggest security risk.”

Why?

Because one compromised account could destroy the entire AWS environment.

Your job as a Cloud Security Engineer is to ensure everyone has only the permissions required for their role.

That is exactly what IAM Policies do.

🏢 In the Company

CloudNova now has properly organised IAM Groups.

Cloud-Admins

Cloud-Engineers

Developers

Security-Team

SOC-Team

Finance

Auditors

The next challenge is deciding:

What should each group actually be allowed to do?

🌍 What is an IAM Policy?

An IAM Policy is a JSON document that defines permissions.

It answers four questions.

Who?
What Action?
Which Resource?
Allow or Deny?

Every request made in AWS is evaluated against IAM Policies.

🧠 Think Like a Security Engineer

Don’t start by writing JSON.

Start by asking:

Who needs access?

Why do they need access?

What is the minimum permission required?

This is exactly how enterprise security teams work.

🏢 Enterprise Permission Matrix

Before writing policies, CloudNova creates a Permission Matrix.

Group	EC2	S3	IAM	CloudTrail	Billing
Cloud-Admins	Full	Full	Full	Full	Full
Cloud-Engineers	Full	Read/Write	Read	Read	No
Developers	Start/Stop	Read/Write (Dev Only)	No	Read	No
Security-Team	Read	Read	Manage	Manage	Read
SOC-Team	Read	Read	No	Read	No
Finance	No	No	No	No	Billing Only
Auditors	Read	Read	Read	Read	Read

This matrix becomes the blueprint for every IAM Policy.

🏗 Policy Types

AWS supports three major policy types.

AWS Managed Policies

Created by AWS.

Examples

ReadOnlyAccess
AdministratorAccess
PowerUserAccess

Advantages

Easy to use
Maintained by AWS

Disadvantages

Often too broad

Customer Managed Policies

Created by your organisation.

Advantages

More secure
Least Privilege
Easier auditing
Enterprise standard

CloudNova prefers Customer Managed Policies.

Inline Policies

Attached directly to one user or role.

Advantages

Specific

Disadvantages

Difficult to manage
Not reusable

Generally avoided in enterprise environments.

🧩 IAM Policy Structure

Every IAM Policy contains:

Version

Statement

Effect

Action

Resource

Condition (optional)

Example

Policy

│

├── Effect

├── Action

├── Resource

└── Condition

JSON Policy Example

{
    "Version":"2012-10-17",
    "Statement":[
        {
            "Effect":"Allow",
            "Action":"s3:GetObject",
            "Resource":"arn:aws:s3:::cloudnova-dev/*"
        }
    ]
}

Understanding Each Element

Version

Policy language version.

Normally:

2012-10-17

Statement

Contains one or more permission rules.

Effect

Two values exist.

Allow

or

Deny

Explicit Deny always wins.

Action

Defines what can be performed.

Examples

ec2:StartInstances

ec2:StopInstances

s3:GetObject

s3:PutObject

iam:CreateUser

Resource

Specifies where the permission applies.

Example

Specific S3 Bucket

Specific EC2 Instance

Specific IAM Role

Never use

unless absolutely necessary.

🛡 Least Privilege

Instead of

s3:*

prefer

s3:GetObject

s3:PutObject

Only grant exactly what is required.

🚫 Wildcards

Bad

Action

*

Resource

*

Good

Action

ec2:StartInstances

ec2:StopInstances

Resource

Production EC2 ARN

🏗 Enterprise Policy Design

CloudNova Developers need:

✅ Start EC2

✅ Stop EC2

✅ Read CloudWatch

✅ Upload to Development S3

They should NOT:

❌ Delete EC2

❌ Delete Buckets

❌ Manage IAM

❌ Access Billing

🧪 Enterprise Mission 01 — Review AWS Managed Policies

Console

IAM

↓

Policies

Review

AdministratorAccess
ReadOnlyAccess
PowerUserAccess

Questions

What permissions do these policies grant?

Would you use them in production?

🧪 Enterprise Mission 02 — List Policies

aws iam list-policies --scope AWS

Customer Policies

aws iam list-policies --scope Local

🧪 Enterprise Mission 03 — Create Customer Managed Policy

Create file

DeveloperPolicy.json

Example

{
  "Version":"2012-10-17",
  "Statement":[
    {
      "Effect":"Allow",
      "Action":[
        "ec2:Describe*",
        "ec2:StartInstances",
        "ec2:StopInstances"
      ],
      "Resource":"*"
    }
  ]
}

Create Policy

aws iam create-policy \
--policy-name DeveloperPolicy \
--policy-document file://DeveloperPolicy.json

🧪 Enterprise Mission 04 — Attach Policy

Attach to Developers Group.

aws iam attach-group-policy \
--group-name Developers \
--policy-arn POLICY_ARN

Verify

aws iam list-attached-group-policies \
--group-name Developers

🧪 Enterprise Mission 05 — Simulate Access

Review the attached policy.

Questions

Can Developers:

✅ Start EC2?

✅ Stop EC2?

❌ Delete IAM Users?

❌ Delete S3 Buckets?

🧪 Enterprise Mission 06 — Review Policy JSON

Open your policy.

Identify

Version
Statement
Effect
Action
Resource

Explain each section.

🏢 Enterprise Scenario

CloudNova launches a new AI Engineering division.

The AI Team needs:

Read training data
Launch GPU EC2
Access SageMaker
Store models

Should they receive AdministratorAccess?

Or should a dedicated IAM Policy be created?

Design your recommendation.

📊 Knowledge Check

What is an IAM Policy?
What are the three main policy types?
What is the difference between AWS Managed and Customer Managed Policies?
What does Effect define?
What does Action define?
What does Resource define?
Why is Least Privilege important?
Why should Wildcards be avoided?
Which CLI command creates a policy?
Which CLI command attaches a policy to a Group?

📝 Assignment

Prepare an Enterprise IAM Policy Design Guide.

Include:

IAM Policy Overview
AWS Managed vs Customer Managed Policies
Enterprise Permission Matrix
JSON Policy Structure
Developer Policy Example
Screenshots
AWS CLI Commands
Lessons Learned

Length:

5–6 Pages

📋 Lesson Completion Checklist

Task	Status
Reviewed AWS Managed Policies	☐
Listed Policies	☐
Created Customer Managed Policy	☐
Attached Policy to Group	☐
Reviewed Policy JSON	☐
Completed Enterprise Permission Matrix	☐
Completed Assignment	☐

💡 Key Takeaways

After completing this lesson, you should understand:

IAM Policies define what identities can do in AWS.
A Permission Matrix should be designed before writing policies.
Customer Managed Policies provide greater control and support the principle of least privilege.
Well-structured JSON policies are easier to maintain and audit.
Enterprise access should always be based on business requirements rather than granting broad administrative permissions.

📚 Further Reading

AWS IAM JSON Policy Elements
AWS IAM Best Practices
AWS Security Pillar – Well-Architected Framework
AWS CLI Command Reference – IAM Policies

🚀 Next Lesson

➡️ Lesson 06 — IAM Roles