Most AWS problems are IAM problems in disguise. Know this cold.
Identities:
- User — long-lived identity for humans, with credentials (password, access keys)
- Group — collection of users; policies attached to the group apply to all members
- Role — temporary identity assumed by services, users, or workloads. Has no long-lived credentials.
- Service-linked role — pre-defined role created by AWS services for their own use (e.g., AWSServiceRoleForAutoScaling)
Policies:
- Identity-based — attached to a user, group, or role. Defines what the identity can do.
- Resource-based — attached to a resource (S3 bucket, KMS key, SNS topic). Defines who can access this resource.
- Permissions boundary — a guardrail that limits the maximum permissions an identity can have, even if a policy grants more.
- Service control policy (SCP) — applied at the AWS Organizations level. Limits what accounts in the organisation can do.
- Session policy — passed when assuming a role; further restricts the session's permissions.
Policy evaluation order:
- Explicit deny anywhere → deny (overrides everything)
- SCP doesn't allow it → deny
- Permissions boundary doesn't allow it → deny
- Session policy doesn't allow it → deny
- Identity or resource policy allows it → allow
- Default → deny