Identity-Based versus Resource-Based Policies
Compare policies attached to identities with those on resources.
Two Places to Attach
Permissions in AWS come from policies attached in two places: to an identity (user, group, or role) or to a resource (like an S3 bucket or KMS key). Knowing which type applies, and how they combine, is essential for the exam because cross-account access depends entirely on this distinction.
Identity-Based Policies
An identity-based policy is attached to an IAM principal and defines what that principal can do. It has no Principal element because the principal is whoever it is attached to. These can be AWS-managed, customer-managed, or inline policies, and they are the most common way to grant permissions.
All lessons in this course
- Anatomy of an IAM Policy Document
- Identity-Based versus Resource-Based Policies
- The Policy Evaluation Decision Flow
- Conditions, Wildcards, and Policy Variables