Definition: A document that defines permissions and can be applied to users, groups, and roles.
Structure
Format: Policies are written in JSON, consisting of key-value pairs (attributes and values). Permissions
Implicit Deny: By default, all permissions are implicitly denied. Most Restrictive Policy: When multiple policies apply, the most restrictive policy takes precedence. Tools and Features
IAM Policy Simulator: A tool to help understand, test, and validate the effects of access control policies. Policy Elements
Condition Element: Used to apply further conditional logic to policies.
Types of IAM Policies
Customer Managed Policies
Managed Policies
Definition: Policies created and administered by AWS. Common Use Cases: Designed for common job functions. Ease of Use: Saves you the effort of creating policies yourself. Attachment: Can be attached to multiple users, groups, or roles across AWS accounts. Immutability: Permissions cannot be changed. Job-Specific Managed Policies:
Customer Managed Policies
Definition: Standalone policies that you create and administer in your own AWS account. Customization: Can be customized to meet specific needs. Attachment: Can be attached to multiple users, groups, and roles within your account. Creation: Can be created by copying and modifying an existing managed policy. Recommendation: Ideal when AWS Managed Policies do not meet your specific requirements.
Inline Policies
Definition: Policies embedded directly within a user, group, or role. 1:1 Relationship: Directly attached to a single entity. Deletion: When the user, group, or role is deleted, the inline policy is also deleted. Use Case: Useful when you need to ensure that the permissions in a policy are not inadvertently assigned to other entities. AWS Recommendation: Generally recommends using managed policies instead of inline policies for ease of management and reusability. Summary of AWS Managed and Customer Managed Policies
Standalone: Have their own Amazon Resource Name (ARN). Pre-Defined Permissions: Permissions set by AWS and cannot be changed. Common Use Cases: Designed for many common scenarios and job functions. Customer Managed Policies: Standalone: Administered within your AWS account. Customizable: Permissions can be tailored to specific needs. Reusability: Can be attached to multiple principal entities within your account. 
IAM Policy
