Techie BabajiLearn to Code. Build Real Skills.
AWS · Foundations

IAM

IAM (Identity and Access Management) decides who can do what in your AWS account. Every API call is checked against IAM policies.

Beginner 5 min Lesson 3 of 30
Before you start:Introduction to AWS
0/30 in AWS
On this page · 5 min · Beginner

On this page

  1. Learning objectives
  2. Explanation
  3. Code example
  4. Step by step
  5. Real-world use
  6. Common mistakes
  7. Best practices
  8. Remember this
  9. Practice exercise
  10. Mini quiz
  11. Related topics
  12. My notes
Reading time
5 min
Difficulty
Beginner
Updated
Oct 29, 2026

Related tutorials

Interview questions

Learning objectives#

  • Explain users, groups, roles and policies
  • Read and write a JSON policy
  • Apply least privilege
  • Use roles for applications

Explanation#

A policy is a JSON document of statements: Effect (Allow/Deny), Action (s3:GetObject), Resource (an ARN) and optional Condition.

By default everything is denied. An explicit Allow grants access; an explicit Deny always wins.

Roles are identities with temporary credentials that are assumed — by an EC2 instance, a Lambda function, an ECS task, a GitHub Actions workflow or a person.

Applications should use roles, never long-lived access keys embedded in code.

Code example: Least-privilege policy for one bucket folder#

JSONLeast-privilege policy for one bucket folder Illustrative
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadWriteProductImages",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::shop-assets-123/products/*"
    },
    {
      "Sid": "ListOnlyProductsPrefix",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::shop-assets-123",
      "Condition": { "StringLike": { "s3:prefix": ["products/*"] } }
    }
  ]
}
Expected output
An app with this policy can read, upload and list files under products/ in one bucket — and nothing else in the account.

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

  1. Version 2012-10-17 is the current policy language version.
  2. The first statement allows reading and writing objects under one prefix.
  3. ListBucket applies to the bucket ARN itself, limited by a prefix condition.
  4. Everything not allowed is implicitly denied.

Real-world use case#

An EC2 instance role carries this policy, so the Node.js API on that instance can upload product images without any keys in its configuration.

Common mistakes#

Using "Action": "*" and "Resource": "*"

Full admin for an app means one bug or leak compromises everything.

Access keys in code or Git

Bots scan public repos for AWS keys within minutes. Use roles; rotate or delete any leaked key immediately.

Best practices#

  • Grant least privilege and refine with IAM Access Analyzer
  • Use roles for workloads
  • Assign permissions to groups or permission sets, not individuals
  • Require MFA for humans

Remember this#

Default deny → explicit Allow → explicit Deny always wins.

Policy = Effect + Action + Resource (+ Condition).

Apps use roles. No keys in code.

Practice exercise#

Your task: Write a policy statement that allows only reading items from the DynamoDB table Orders (GetItem and Query).

Show solution
JSON Illustrative
{
  "Effect": "Allow",
  "Action": ["dynamodb:GetItem", "dynamodb:Query"],
  "Resource": "arn:aws:dynamodb:ap-south-1:123456789012:table/Orders"
}

Mini quiz#

IAM quizMultiple choice Question 1 of 2

If one policy allows s3:DeleteObject and another explicitly denies it, what happens?

Score so far: 0/0

Want more? Practise all AWS MCQs · AWS interview questions

My notes#

Saved in this browser.

Progress is saved in this browser. Sign in to sync.