IAM Policy
A JSON document that defines the permissions an IAM identity is allowed or denied.
An IAM policy is a JSON document containing statements, each with an Effect (Allow or Deny), one or more Actions such as s3:GetObject, and the Resources they apply to. Policies are identity-based (attached to a user, group, or role) or resource-based (attached to a resource, like an S3 bucket policy). Access is implicitly denied by default, so permissions must be explicitly granted. AWS managed policies are reusable pre-built documents; customer managed policies are reusable but custom-authored; inline policies embed in a single identity and are deleted with it. An explicit Deny always overrides any Allow.
PlayPrepHQ study notes are written and reviewed against primary exam sources. How we create & review content →