Security & governance
IAM policy
An IAM policy is a document that defines what an identity is permitted to do. IAM stands for identity and access management. The policy is attached to a user, a group or a role, lists the operations allowed or denied and the resources they apply to, and is evaluated each time that identity makes a request.
What does an IAM policy contain?
Like a bucket policy, an IAM policy is a JSON document made of statements with an Effect, a set of Actions, the Resources they apply to and optional Conditions. It has no Principal element, because the principal is whoever the policy is attached to. A policy granting an application read access to one bucket would allow the get-object and list-bucket actions on that bucket and its keys, and nothing else.
What can a policy be attached to?
Identities come in several forms, and the choice affects how access is managed over time.
| Identity | What it is | Typical use |
|---|---|---|
| User | A person or application with long-lived credentials | Administrators, legacy applications |
| Group | A collection of users | Applying the same permissions to a team |
| Role | An identity that is assumed temporarily | Applications, cross-account access, federation |
| Service account | An identity for software | Backup jobs, pipelines, automation |
How is least privilege applied to storage?
Least privilege means each identity has only the permissions its task requires. For storage, that translates into separate identities per application, actions limited to what the application does, resources limited to its own buckets or prefixes, and no deletion or configuration rights unless they are needed. A backup application needs to write and read its own bucket. It does not need to change bucket policy, and the identity it uses should not be able to remove Object Lock settings. Scoping this narrowly limits what a stolen access key can do.
How do IAM policies and bucket policies work together?
Both are evaluated on every request. IAM policies answer what this identity can do across the system. Bucket policies answer who can use this bucket. An explicit Deny in either blocks the request. A practical division is to grant day-to-day permissions through IAM policies attached to roles and to use bucket policies for guardrails that must hold whatever identity policies say. On multi-tenant storage, each account manages its own identities and policies. S3 access policies and backup credential security show both in use.
Frequently asked questions
Is IAM specific to one cloud provider?
The term comes from cloud platforms. Many on-premises object storage systems implement a compatible model of users, groups, roles and policies.
What is the difference between a role and a user?
A user has permanent credentials. A role is assumed for a session and issues temporary credentials, which limits the damage if they leak.
What happens when no policy mentions an action?
It is denied. Access has to be explicitly allowed.
Related terms
- Bucket policy: rules attached to the bucket instead of the identity.
- Multi-tenant storage: accounts that each have their own identities.
- S3 API: the operations policies refer to.
- S3 bucket: the resource most storage policies scope to.
- Key management service (KMS): another system whose access policies control.