The many different kinds of AWS Policies

Identity Policy – Assigned to a user group or role, can be either 1.) in-line with the identity, 2.) User Managed Policy (defined by an User with the permission to do so), 3.) AWS defined managed policies.

Resource Policy – Assigned to an AWS resource like S3 or EC2. Resource-based policies are inline policies. There are no managed resource-based policies.

When applying policies to a role, a role will contain both a Trust Policy and and Identity Policy:

Trust Policy – Is a specific type of resource policy for IAM Roles – a trust policy defines who can assume a role, and under what circumstances / conditions:

https://aws.amazon.com/blogs/security/how-to-use-trust-policies-with-iam-roles/#:~:text=Trust%20policy%20%E2%80%93%20The%20trust%20policy,based%20policy%20for%20IAM%20roles.

Session Policies – are advanced policies you pass as a parameter when programmatically creating a session for a role or federated user – see under Session Policies:

https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html

Leave a Comment

Scroll to Top