AWS Certified Cloud Practitioner / Identity and Access Management

IAM Policies

🛡 IAM Policy Inheritance in AWS

AWS uses IAM policies to control permissions.

With AWS Identity and Access Management (IAM), you define who can do what, on which resources.

Understanding how policies are inherited is key to managing permissions securely — especially in real-world AWS setups.

Let's break it down step by step.

👥 Understanding IAM Policy Inheritance

Imagine a company structure with multiple users and groups.

🧑‍💻 Developers Group

⚙ Operations Group

A policy attached to a group applies only to that group's members. Click a permission, click a person, or run the isolation check below.

👤 Individual User (No Group)

Alice, Bob and Charles get permissions from a policy attached to their group. Fred belongs to no group — so his policy is attached straight to him.

🔀 Multiple Group Memberships

Charles is in Developers. David is in Operations. Both are also in Audit Team.

🧩 IAM Policy Structure (JSON Format)

IAM policies are written in JSON.

You will see this structure frequently when:

  • Creating custom policies

  • Reading managed policies

  • Troubleshooting permission issues

Here is an example policy granting access to objects in an S3 bucket: