Creating an AWS IAM Policy: AWS Security

However you choose to do it: your AWS IAM policy must be a good fit for your application’s actual access needs. We’ll discuss three ways to get it done.

Welcome to part six of our AWS Security Series. Last week I introduced Identity & Access Manager (IAM) and how you can control access to resources by using the predefined user, group, and role policy templates created and designed by AWS. This week, I want to show you how you can create your own custom IAM policy in the form of a JSON script and test it using the AWS Policy Simulator.

This article will cover the main elements, syntax, and structure of an IAM policy, and different ways to create your own IAM policy. Using a predefined IAM policy is more likely than not a perfect match for the permissions you actually need. However, now and again, you may want to tweak a small part of it to more exactly fit your requirements. Remember, when it comes to security, the more precisely you can define your controls, the better. You should avoid being lazy and deploying implementations that are “close enough” rather than hand crafting the perfect fit.

An IAM Policy is a JSON script made up of statements following a set syntax for allowing or denying permissions to an object within your AWS environment.

IAM Policy Syntax

Each policy has to have at least one statement whose structure might look like this:
IAM AWS policy statement
The ‘Effect’ element can be set to either ‘Allow’ or ‘Deny’. These are explicit. By default, access to your resources is denied and so therefore if this is set to ‘Allow’ it replaces the default ‘Deny’. Similarly, if this were set to ‘Deny’ it would override any previous ‘Allow’. The ‘Action’ Element corresponds to API calls to AWS Services that authenticate through IAM. For example, this example represents API calls to delete a bucket (the action) within S3 (the service):

“Action”:”s3:DeleteBucket”

You are able to list multiple actions, if required, by using a comma to separate them:

“Action”:”s3:DeleteBucket”,”s3:CreateBucket”

Wildcards (*) are also allowed. So, for example, you could create an action to carry out all APIs relating to S3, such as:

“Action”:”s3:*”

The ‘Resource’ element specifies the actual resource you wish the permission to be applied to. AWS uses unique identifiers known as ARNs (Amazon Resource Name) to specify resources. Typically ARNs follow a syntax of:

arn:partition:service:region:account-id:resource
  • ‘Partition’ – This relates to the partition that the resource is found in. For standard AWS regions, this section would be ‘aws’.
  • ‘Service’ – This reflects the specific AWS service, for example ‘s3’ or ‘ec2’.
  • ‘Region’ – This is the region where the resource is located. Some services do not need a region specified, so this can sometimes be left blank.
  • ‘Account-ID’ – This is your AWS Account ID (without hyphens). Again, some services do not need this information, and so can be left blank.
  • ‘Resource’ – The value of this field will depend on the AWS service you are using. For example, if I were using the Action: “Action”:”s3:DeleteBucket”, then I could use the bucket name that I wanted the permission to delete:  arn:aws:s3:::cloudacademyblog.

The ‘Condition’ element of the IAM Policy is an optional element that allows you to specify when the permissions will be activated based upon set conditions. Conditions use key value pairs, and all conditions must be met for the permissions to be activated. Here’s a full listing of these conditions.
Now we have a basic understanding of how JSON scripts are put together and their general flow, let’s see how we can modify existing policies to tweak them to your needs.

Copying an existing AWS IAM Policy

There will be times when you may not need to create a policy completely from scratch. You may be able to get away with adapting one that already exists. This can potentially save you a lot of time and effort. Open up your AWS console and select ‘IAM > Policies > Create Policy’. You will be presented with these three options:
create AWS IAM policy
For this example, select “Copy an AWS Managed Policy”.

You will then be shown a list all existing AWS managed policies, and there are a LOT! You can narrow your search by using the search function at the top of the page. For this example, I am going to search for S3 policies.
copy an AWS managed policy
I will select the “AmazonS3FullAccess” IAM policy with the goal of modifying it to only allow full access to a specific bucket (cloudacademyblog).
Once selected, it displays the following JSON policy:
AWS IAM policy: allow

After reviewing this policy, I am happy with the ‘Effect’ and ‘Action’ elements, however I want to modify the ‘Resource’ section, which is currently set to “all” with the * wildcard. I will add the ARN for a specific bucket called ‘cloudacademyblog’. To do this, all I need to do is edit the policy and change the ‘Resource’ line to:

"Resource": "arn:aws:s3:::cloudacademyblog"

Once edited, I can give the policy a meaningful name and click Save. This policy will now appear in your list of the policies you can assign to your groups and users. Once assigned, it’s always a good idea to test your policy via the simulator by clicking on Simulate Policy.
AWS IAM policy: simulator permissions

This will load the policy simulator for the policy I just created:
AWS IAM policy: simulator
This shows the policy’s JSON script on the left and, on the right hand side, I can select specific Services and Actions. The image below shows that I have selected ‘S3’ as the Service and ‘Create Bucket’ and ‘Delete Bucket’ as the Actions. I have also added the ARN for the cloudacademyblog bucket in the ‘Resource Type’ field.
AWS IAM policy: Settings
Once all the information you want to test is there, click ‘Run Simulation
AWS IAM policy allowed settings
The simulator results show that this IAM policy allows those actions to be carried out on the cloudacademyblog bucket. To confirm these actions are not possible on other buckets, I ran the following simulation with the ‘Resource’ set to all (checking all buckets) with the * wildcard:
AWS IAM policy - status denied
As you can see, this was denied by the policy as the policy only states that we have full access to the arn:aws:s3:::cloudacademyblog bucket.

Using the IAM Policy Generator

If you do not yet feel confident enough to edit existing policies, then AWS provides the IAM Policy Generator. From with the AWS Console select ‘IAM > Policies > Create Policy’ and this time select ‘Policy Generator’.

From here, via drop down boxes, you can select the Effect, Service, Action, and Resource. Additionally, if required, you can also set up conditions. Once all your options are set, click the ‘Add Statement’ button.

The image below shows that I have simply replicated the IAM policy I created in the last section, but this time via the Policy Generator:
AWS IAM policy - Generator
When you are happy with your new IAM policy, select ‘Next Step’. From there, you can give your new IAM policy a name and description, and view it as a JSON script. Click ‘Create Policy’ and then attach it to any groups or users as needed.

Writing your own IAM policy

If you’re ready to write your own IAM policy from scratch, there’s nothing stopping you. From the AWS Console, select ‘IAM > Policies > Create Policy’, and this time select ‘Create your own policy’.
AWS IAM Review policy
Here you are presented with a blank canvas allowing you to give your policy a name and description…but most importantly, a blank policy document where you can write your JSON document adhering to the policy syntax rules discussed at the beginning of this article.

Once you are happy with your policy, use the ‘Validate Policy’ button at the bottom to determine if there are any errors with your policy. Again, when you are finished click ‘Create Policy’.

As you can see there are a number of methods available to help you refine your IAM policies, and you aren’t forced to use predefined policies. Once you get used to the syntax – and benefits – of writing your own policies, you will be able to effectively and efficiently lock down access to your resources to ensure they are only accessed by authorized API calls.

There are many,  many specific commands that can be controlled through an IAM policy, but they’re a bit beyond the scope of this post. AWS provides great API listings for the different services through their extensive documentation for advanced policy writers.

What are the key elements we have we learned this week?

  • It is always best to refine your IAM Policy down to an API call level for the tightest level of security.
  • Policies can be created in a number of ways via IAM: from writing your own JSON script to assisted creation via drop-down menus.
  • Testing your policies via the Simulator is a very important part of ensuring they only allow or deny exactly what they were designed for.

In my next AWS Security article, I will be taking a look at Federated access with IAM, Trusted Advisor, AWS Billing restrictions and AWS Linked accounts. Until then I hope you all have a Happy New year!
Thank you for taking the time to read my article. If you have any feedback please leave a comment below.

Avatar

Written by

Stuart Scott

Stuart is the AWS content lead at Cloud Academy where he has created over 40 courses reaching tens of thousands of students. His content focuses heavily on cloud security and compliance, specifically on how to implement and configure AWS services to protect, monitor and secure customer data and their AWS environment.


Related Posts

Patrick Navarro
Patrick Navarro
— January 22, 2020

Top 5 AWS Salary Report Findings

At the speed the cloud tech space is developing, it can be hard to keep track of everything that’s happening within the AWS ecosystem. Advances in technology prompt smarter functionality and innovative new products, which in turn give rise to new job roles that have a ripple effect on t...

Read more
  • AWS
  • salary
Alisha Reyes
Alisha Reyes
— January 6, 2020

New on Cloud Academy: Red Hat, Agile, OWASP Labs, Amazon SageMaker Lab, Linux Command Line Lab, SQL, Git Labs, Scrum Master, Azure Architects Lab, and Much More

Happy New Year! We hope you're ready to kick your training in overdrive in 2020 because we have a ton of new content for you. Not only do we have a bunch of new courses, hands-on labs, and lab challenges on AWS, Azure, and Google Cloud, but we also have three new courses on Red Hat, th...

Read more
  • agile
  • AWS
  • Azure
  • Google Cloud Platform
  • Linux
  • OWASP
  • programming
  • red hat
  • scrum
Alisha Reyes
Alisha Reyes
— December 24, 2019

Cloud Academy’s Blog Digest: Azure Best Practices, 6 Reasons You Should Get AWS Certified, Google Cloud Certification Prep, and more

Happy Holidays from Cloud Academy We hope you have a wonderful holiday season filled with family, friends, and plenty of food. Here at Cloud Academy, we are thankful for our amazing customer like you.  Since this time of year can be stressful, we’re sharing a few of our latest article...

Read more
  • AWS
  • azure best practices
  • blog digest
  • Cloud Academy
  • Google Cloud
Avatar
Guy Hummel
— December 12, 2019

Google Cloud Platform Certification: Preparation and Prerequisites

Google Cloud Platform (GCP) has evolved from being a niche player to a serious competitor to Amazon Web Services and Microsoft Azure. In 2019, research firm Gartner placed Google in the Leaders quadrant in its Magic Quadrant for Cloud Infrastructure as a Service for the second consecuti...

Read more
  • AWS
  • Azure
  • Google Cloud Platform
Alisha Reyes
Alisha Reyes
— December 10, 2019

New Lab Challenges: Push Your Skills to the Next Level

Build hands-on experience using real accounts on AWS, Azure, Google Cloud Platform, and more Meaningful cloud skills require more than book knowledge. Hands-on experience is required to translate knowledge into real-world results. We see this time and time again in studies about how pe...

Read more
  • AWS
  • Azure
  • Google Cloud
  • hands-on
  • labs
Alisha Reyes
Alisha Reyes
— December 5, 2019

New on Cloud Academy: AWS Solution Architect Lab Challenge, Azure Hands-on Labs, Foundation Certificate in Cyber Security, and Much More

Now that Thanksgiving is over and the craziness of Black Friday has died down, it's now time for the busiest season of the year. Whether you're a last-minute shopper or you already have your shopping done, the holidays bring so much more excitement than any other time of year. Since our...

Read more
  • AWS
  • AWS solution architect
  • AZ-203
  • Azure
  • cyber security
  • FCCS
  • Foundation Certificate in Cyber Security
  • Google Cloud Platform
  • Kubernetes
Avatar
Cloud Academy Team
— December 4, 2019

Understanding Enterprise Cloud Migration

What is enterprise cloud migration? Cloud migration is about moving your data, applications, and even infrastructure from your on-premises computers or infrastructure to a virtual pool of on-demand, shared resources that offer compute, storage, and network services at scale. Why d...

Read more
  • AWS
  • Azure
  • Data Migration
Wendy Dessler
Wendy Dessler
— November 27, 2019

6 Reasons Why You Should Get an AWS Certification This Year

In the past decade, the rise of cloud computing has been undeniable. Businesses of all sizes are moving their infrastructure and applications to the cloud. This is partly because the cloud allows businesses and their employees to access important information from just about anywhere. ...

Read more
  • AWS
  • Certifications
  • certified
Avatar
Andrea Colangelo
— November 26, 2019

AWS Regions and Availability Zones: The Simplest Explanation You Will Ever Find Around

The basics of AWS Regions and Availability Zones We’re going to treat this article as a sort of AWS 101 — it’ll be a quick primer on AWS Regions and Availability Zones that will be useful for understanding the basics of how AWS infrastructure is organized. We’ll define each section,...

Read more
  • AWS
Avatar
Dzenan Dzevlan
— November 20, 2019

Application Load Balancer vs. Classic Load Balancer

What is an Elastic Load Balancer? This post covers basics of what an Elastic Load Balancer is, and two of its examples: Application Load Balancers and Classic Load Balancers. For additional information — including a comparison that explains Network Load Balancers — check out our post o...

Read more
  • ALB
  • Application Load Balancer
  • AWS
  • Elastic Load Balancer
  • ELB
Albert Qian
Albert Qian
— November 13, 2019

Advantages and Disadvantages of Microservices Architecture

What are microservices? Let's start our discussion by setting a foundation of what microservices are. Microservices are a way of breaking large software projects into loosely coupled modules, which communicate with each other through simple Application Programming Interfaces (APIs). ...

Read more
  • AWS
  • Docker
  • Kubernetes
  • Microservices
Nisar Ahmad
Nisar Ahmad
— November 12, 2019

Kubernetes Services: AWS vs. Azure vs. Google Cloud

Kubernetes is a popular open-source container orchestration platform that allows us to deploy and manage multi-container applications at scale. Businesses are rapidly adopting this revolutionary technology to modernize their applications. Cloud service providers — such as Amazon Web Ser...

Read more
  • AWS
  • Azure
  • Google Cloud
  • Kubernetes