0Pricing
AWS Solutions Architect · Lesson

IAM Roles and Policies

Write JSON policy documents, attach them to roles, and understand the difference between identity-based and resource-based policies.

IAM Roles and Policies is a free AWS Solutions Architect lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the AWS Solutions Architect learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

IAM Policies: The Permission Language

An IAM policy is a JSON document that says what's allowed. Each statement has an Effect (Allow or Deny), an Action, and a Resource. The code shows one.

{
  'Version': '2012-10-17',
  'Statement': [
    {
      'Effect': 'Allow',
      'Action': [
        's3:GetObject',
        's3:PutObject'
      ],
      'Resource': 'arn:aws:s3:::my-bucket/*'
    }
  ]
}

Identity-Based vs Resource-Based Policies

An identity-based policy attaches to a user or role and says what they can do. A resource-based policy attaches to the thing itself and says who can touch it.

# Example S3 bucket policy (resource-based)
{
  'Version': '2012-10-17',
  'Statement': [{
    'Effect': 'Allow',
    'Principal': {
      'AWS': 'arn:aws:iam::123456789012:role/MyAppRole'
    },
    'Action': 's3:GetObject',
    'Resource': 'arn:aws:s3:::my-bucket/*'
  }]
}

IAM Roles: Temporary Identities

An IAM role is an identity you assume for a short while. It hands out temporary credentials that expire — perfect for EC2, Lambda, and other services.

# Attach an IAM role to an EC2 instance (instance profile)
aws ec2 associate-iam-instance-profile \
  --instance-id i-0abcdef1234567890 \
  --iam-instance-profile Name=MyEC2Role

Trust Policies: Who Can Assume the Role

Every role has a trust policy saying who's allowed to assume it, plus permission policies saying what it can do once assumed. No trust policy, no access.

# Trust policy for a Lambda execution role
{
  'Version': '2012-10-17',
  'Statement': [{
    'Effect': 'Allow',
    'Principal': {
      'Service': 'lambda.amazonaws.com'
    },
    'Action': 'sts:AssumeRole'
  }]
}

AWS Service Roles: EC2 and Lambda

When EC2 needs to call AWS, give it an instance profile wrapping a role. Credentials rotate automatically — no hardcoded keys. Lambda works the same way.

# Retrieve role credentials from EC2 metadata (IMDSv2)
TOKEN=$(curl -X PUT 'http://169.254.169.254/latest/api/token' \
  -H 'X-aws-ec2-metadata-token-ttl-seconds: 21600')
curl -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/iam/security-credentials/MyEC2Role

Cross-Account Role Assumption

A cross-account role lets a user in one account assume a role in another and reach its resources. It's how multi-account setups avoid duplicate users everywhere.

# Assume a cross-account role from Account A
aws sts assume-role \
  --role-arn arn:aws:iam::999999999999:role/CrossAccountRole \
  --role-session-name my-session

Policy Conditions: Fine-Grained Control

A Condition adds extra rules to a policy — like requiring MFA, or limiting access to a certain IP range or region. It makes permissions much tighter.

# Policy that requires MFA for sensitive actions
{
  'Effect': 'Deny',
  'Action': ['iam:*', 'cloudtrail:*'],
  'Resource': '*',
  'Condition': {
    'BoolIfExists': {
      'aws:MultiFactorAuthPresent': 'false'
    }
  }
}

Permission Boundaries

A permissions boundary caps the most an identity can ever have, even if a policy grants more. It's the safety net for letting developers create their own roles.

# Attach a permissions boundary to a user
aws iam put-user-permissions-boundary \
  --user-name alice \
  --permissions-boundary arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

Policy Evaluation Logic

When AWS checks a request, one rule wins above all: an explicit Deny always blocks it. After that, every layer of policy must agree to allow access.

IAM Policy Simulator

The IAM Policy Simulator tests whether an identity can do something — without actually running it. Great for debugging permissions before going live.

# Simulate an IAM policy evaluation via CLI
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/alice \
  --action-names s3:PutObject \
  --resource-arns arn:aws:s3:::my-bucket/*

Roles for Federated Access

Outside users from Okta, Google, or Active Directory can assume roles through federation (SAML or OIDC). You grant millions of people access with zero IAM users.

Quick Check

Test your understanding of AWS Solutions Architect (SAA-C03) concepts from this lesson.

Lesson Recap

Quick recap: policies are JSON rules for Allow and Deny, roles hand out temporary credentials, and conditions add fine-grained control. Next: least privilege.

Frequently asked questions

Is the “IAM Roles and Policies” lesson free?

Yes — the full text of “IAM Roles and Policies” is free to read here on the web, and the AWS Solutions Architect course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the AWS Solutions Architect course, upgrade to CoddyKit PRO.

What will I learn in “IAM Roles and Policies”?

Write JSON policy documents, attach them to roles, and understand the difference between identity-based and resource-based policies. You practise AWS Solutions Architect with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start AWS Solutions Architect?

No prior experience is required. AWS Solutions Architect on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “IAM Roles and Policies” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this AWS Solutions Architect lesson?

Yes. Every AWS Solutions Architect lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. IAM Users and Groups
  2. IAM Roles and Policies
  3. Least-Privilege Principle
  4. IAM Best Practices and MFA
← Back to AWS Solutions Architect