# IAM: Policies and Permissions

* Users or Groups can be assigned JSON documents called policies.&#x20;
* These policies define the permissions of the users.&#x20;
* In AWS you apply the least privilege principle: don’t give more permissions than a user needs.

Here we allow user to describe ec2 and few access to CloudWatch.

<figure><img src="https://285499051-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fax7GJwknK1WgU2PuMxcB%2Fuploads%2FluC86S1emHq6EnmISGaW%2Fimage.png?alt=media&#x26;token=ffc7bcee-a17d-44b6-9ac5-7cb49ec85ea7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://285499051-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fax7GJwknK1WgU2PuMxcB%2Fuploads%2FtneCKdGDgnMDj7xBWctF%2Fimage.png?alt=media&#x26;token=53f5a8be-1908-40e2-bcdc-19052296a11d" alt=""><figcaption></figcaption></figure>

## IAM Policies Structure

<figure><img src="https://285499051-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fax7GJwknK1WgU2PuMxcB%2Fuploads%2Fm2eYbVHj8Ubh90efBWUv%2Fimage.png?alt=media&#x26;token=9671b959-5ba9-4bdf-b4c9-df1c26d1f237" alt=""><figcaption></figcaption></figure>

### Consists of&#x20;

* <mark style="color:red;">**Version**</mark><mark style="color:red;">: policy language version, always include “2012 -10-17”</mark>
* <mark style="color:orange;">**Id**</mark><mark style="color:orange;">: an identifier for the policy (optional) \*</mark>
* <mark style="color:red;">**Statement**</mark><mark style="color:red;">: one or more individual statements (required)</mark>&#x20;

### Statements consists of&#x20;

* <mark style="color:orange;">**Sid**</mark><mark style="color:orange;">: an identifier for the statement (optional) \*</mark>
* <mark style="color:yellow;">**Effect**</mark><mark style="color:yellow;">: whether the statement allows or denies access (Allow, Deny)</mark>&#x20;
* <mark style="color:green;">**Principal**</mark><mark style="color:green;">: account/user/role to which this policy applied to</mark>&#x20;
* <mark style="color:purple;">**Action**</mark><mark style="color:purple;">: list of actions this policy allows or denies</mark>&#x20;
* <mark style="color:green;">**Resource**</mark><mark style="color:green;">: list of resources to which the actions applied to</mark>&#x20;
* <mark style="color:orange;">**Condition**</mark><mark style="color:orange;">: conditions for when this policy is in effect (optional) \*</mark>
