The Lesson
- The ARN uniquely identifies AWS resources, allowing precise specification in IAM policies. In cloud security, knowing the exact resource is vital to restrict or grant access properly. Properly defining the resource scope ensures that access is given only to specific entities (like logs in this case), preventing unnecessary exposure to other resources.
- Inline policies attach directly to the user/group/role and only work for the thing they are attached to. You write them for that user and cannot reuse them anyplace else.
- Managed policies are central policies you write once and can attach wherever you want. If you update a managed policy, that change applies instantly to everything using it. There are two types of managed policies:
- AWS managed policies are standard ones AWS writes and maintains, which customers can use.
- Customer managed policies are ones you write yourself, which only exist in your AWS Account.
The Lab
- Created a Custom Policy for read (s3:GetObject) and write (s3:PutObject) to our CloudTrail bucket
IAM policies define what actions users, roles, and services can perform. Writing policies allows for granular control. The Visual Policy Editor simplifies policy creation by providing an easy-to-understand interface.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::rmogull-slaw/*"
}
]
}