AWS
Policy Generator

What Is an AWS IAM Policy and How Do You Write One?

An AWS IAM policy is a JSON document that defines which AWS API actions a principal (user, role, or service) is allowed or denied to perform on which resources, and optionally under what conditions. Writing policies by hand is error-prone — this generator gives you a visual UI to build correct, production-safe policies in seconds.

Types of AWS Policies

• Identity-based policies — Attached to IAM users, groups, or roles. Control what that identity can do.
• Resource-based policies — Attached to a resource like an S3 bucket or SQS queue. Control who can access that resource.
• Permissions boundaries — Set the maximum permissions an IAM entity can have, regardless of attached policies.
• Service control policies (SCPs) — Applied at the AWS Organisation level to restrict maximum permissions across accounts.
• Session policies — Passed inline when assuming a role to further restrict that session's permissions.

The Six Policy Elements Explained

Version: Always use 2012-10-17. This unlocks modern IAM features like policy variables (${aws:username}).

Effect: Either Allow or Deny. An explicit Deny always wins over any Allow — across all policies evaluated for a request.

Principal: Specifies who the statement applies to. Required for resource-based policies. Can be an AWS account (arn:aws:iam::123456789012:root), an IAM role, a service (e.g. lambda.amazonaws.com), or a wildcard (*).

Action: A list of AWS API actions in service:Action format, e.g. s3:GetObject, ec2:DescribeInstances. Use * to mean all actions. Use s3:* to mean all S3 actions.

Resource: The ARN(s) the statement applies to. Use * to match all resources. Use wildcards like arn:aws:s3:::my-bucket/* to match all objects inside a bucket.

Condition: Optional constraints using condition keys, operators, and values. Common patterns: require MFA, restrict by IP, require HTTPS, or limit to a specific AWS region.

IAM Policy Evaluation Logic

AWS evaluates all applicable policies in this order: (1) an explicit Deny in any policy immediately denies the request; (2) an explicit Allow grants access; (3) if no Allow is found, the request is implicitly denied. This means the default state is deny everything — permissions must be explicitly granted.

Security Best Practices

• Apply least-privilege — grant only the specific actions and resources needed, never "Action": "*" with "Resource": "*".
• Use conditions to add guardrails — require MFA, restrict to known IP ranges, or require HTTPS.
• Prefer roles over users — attach policies to roles and assume them rather than creating long-lived access keys.
• Use resource-level permissions — specify exact ARNs rather than wildcards wherever possible.
• Add a Deny with aws:PrincipalOrgID condition in S3 bucket policies to prevent access from outside your AWS Organization.
• Enable AWS IAM Access Analyzer to automatically detect over-permissive policies in your account.

Frequently Asked Questions