AWS IAM Policies in a Nutshell

Re:AWS IAM Policies in a Nutshell by officelineback on Thursday March 23, 2017 @01:15PM (#13941766)

Isn't the "Principal" element only a part of S3 permission policies, not IAM? In IAM the "principal" is implied, it's the user to which the policy is attached. Edit: I see you explain well into the article, but I believe the title of the article could be improved.

[ Parent | on HN ]

Re:AWS IAM Policies in a Nutshell by unkoman on Thursday March 23, 2017 @01:56PM (#13942248)

Principal can be any AWS resource, such as Kinesis firehose or Lambda. Whichever resource that needs the permissions. For example:

            "Statement": [{
                "Effect": "Allow",
                "Principal": {"Service": [
                    "firehose.amazonaws.com"
                                          ]
                              },
                "Action": ["sts:AssumeRole"]
            }
            ]
        }

[ Parent | on HN ]

Re:AWS IAM Policies in a Nutshell by colemorrison on Thursday March 23, 2017 @01:18PM (#13941797)

Yeah, I mention that in the "Who" aka Principal section. It's like that for any resource based policy (i.e. like S3). So IAM Users/groups have it implied, but Resource based ones like S3 do not have it implied.

[ Parent | on HN ]

Re:AWS IAM Policies in a Nutshell by officelineback on Thursday March 23, 2017 @01:20PM (#13941819)

The thing is, an S3 bucket policy is not an IAM policy. It's a bucket policy. They use the same language, format, and syntax, but they are not called the same thing.

[ Parent | on HN ]

Re:AWS IAM Policies in a Nutshell by colemorrison on Thursday March 23, 2017 @01:23PM (#13941855)

Indeed, they're just a "resource" policy. They're still talked about and share the so many same attributes that it became more character saving to say AWS IAM Policies vs. AWS IAM, S3, SNS, SQS, Glacier Policies =P

[ Parent | on HN ]