CloudWiki
Resource
Detect, troubleshoot & optimize AWS environments in real-time ->

Amazon Web Service (AWS)

IAM Policy

Permissions
IAM policy defines the permissions of an identity (users, groups, and roles) or a resource to either allow or deny access for the user to perform an action on a specific resource, regardless of the method that being used to perform the operation, meaning a user with an allowed action can perform the action from the AWS Management Console, the AWS CLI, or the AWS API.
Costs
The cost of using Identity and Access Management (IAM) features is free, as it is included in the overall cost of using Amazon Web Services (AWS). There are no charges for creating or using IAM users, groups, roles, or policies. However, some AWS services, such as Amazon S3 or Amazon EC2, may incur charges for using IAM features, such as creating an IAM role to access an Amazon S3 bucket or an Amazon EC2 instance.
Direct Cost

--

Indirect Cost
No items found.
Terraform Name
aws_iam_policy
IAM Policy
attributes:
  • description - (Optional, Forces new resource) Description of the IAM policy.
  • name - (Optional, Forces new resource) The name of the policy. If omitted, Terraform will assign a random, unique name.
  • name_prefix - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with name.
  • path - (Optional, default "/") Path in which to create the policy. See IAM Identifiers for more information.
  • policy - (Required) The policy document. This is a JSON formatted string. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide
  • tags - (Optional) Map of resource tags for the IAM Policy. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

Associating resources with a
IAM Policy
Resources do not "belong" to a
IAM Policy
Rather, one or more Security Groups are associated to a resource.
Create
IAM Policy
via Terraform:
The following HCL creates an IAM policy
Syntax:

resource "aws_iam_policy" "policy" {
 name        = "test_policy"
 path        = "/"
 description = "My test policy"

 # Terraform's "jsonencode" function converts a
 # Terraform expression result to valid JSON syntax.
 policy = jsonencode({
   Version = "2012-10-17"
   Statement = [
     {
       Action = [
         "ec2:Describe*",
       ]
       Effect   = "Allow"
       Resource = "*"
     },
   ]
 })
}

Create
IAM Policy
via CLI:
Parametres:

create-policy
--policy-name <value>
[--path <value>]
--policy-document <value>
[--description <value>]
[--tags <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]

Example:

aws iam create-policy --policy-name my-policy --policy-document file://policy

Best Practices for
IAM Policy

Categorized by Availability, Security & Compliance and Cost

Medium
EC2 with high privileged policies
No items found.
Critical
ECS task with Admin access (*:*)
Medium
ECS task with high privileged policies
No items found.
Medium
IAM User with high privileged policies
No items found.
Medium
IAM user can execute a Privilege Escalation by using AssumeRole
No items found.
Medium
IAM user can execute a Privilege Escalation by using PassRole
No items found.
Medium
Lambda with high privileged policies
No items found.
Critical
Pod with Admin access (*:*)
Medium
Pod with high privileged policies
No items found.
Medium
Resource has access to get data from S3 bucket
No items found.
Critical
Resource with over permissive DynamoDB GetItem permissions
No items found.
Critical
Resource with over permissive ElastiCache permissions
No items found.
Critical
Resource with over permissive KMS permissions
No items found.
Critical
Resource with over permissive OpenSearch permissions
No items found.
Critical
Resource with over permissive RDS permissions
No items found.
Critical
Resource with over permissive S3 GetObject permissions
No items found.
Explore all the rules our platform covers
Related blog posts
All Resources