IAM policies (JSON structure) in AWS - Step-by-Step Execution

Process Flow - IAM policies (JSON structure)

Start: Define Policy

↓

Specify Version

↓

Add Statement Array

↓

For Each Statement

↓

Define Effect (Allow/Deny)

↓

Specify Actions

↓

Specify Resources

↓

Optional Conditions

↓

End: Complete Policy JSON

IAM policy JSON starts with a version, then includes one or more statements. Each statement defines if it allows or denies actions on resources, optionally with conditions.

Execution Sample

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::example_bucket"
    }
  ]
}

This policy allows listing the contents of a specific S3 bucket.

Process Table

Step	JSON Key Processed	Action	Value Set	Notes
1	"Version"	Set policy version	"2012-10-17"	Defines policy language version
2	"Statement" array start	Begin statements list	Array start	Holds one or more statements
3	Statement[0] "Effect"	Set effect	"Allow"	Allows the specified actions
4	Statement[0] "Action"	Set action	"s3:ListBucket"	Specifies allowed action
5	Statement[0] "Resource"	Set resource	"arn:aws:s3:::example_bucket"	Limits action to this bucket
6	End of Statement array	Close statements list	Array end	No more statements
7	End of JSON	Complete policy	Full JSON ready	Policy is valid and deployable

💡 All required keys processed, policy JSON structure complete and valid

Status Tracker

Variable	Start	After Step 1	After Step 3	After Step 4	After Step 5	Final
Version	undefined	"2012-10-17"	"2012-10-17"	"2012-10-17"	"2012-10-17"	"2012-10-17"
Statement	undefined	[]	[{"Effect": "Allow"}]	[{"Effect": "Allow", "Action": "s3:ListBucket"}]	[{"Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::example_bucket"}]	[{"Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::example_bucket"}]

Key Moments - 3 Insights

Why do we need the "Version" key in the policy JSON?

The "Version" key tells AWS which policy language version to use. Without it, AWS might not understand the policy correctly. See execution_table step 1.

Can a statement have multiple actions or resources?

Yes, actions and resources can be single strings or arrays of strings. This example uses single strings for simplicity. See execution_table steps 4 and 5.

What happens if "Effect" is set to "Deny" instead of "Allow"?

Setting "Effect" to "Deny" explicitly blocks the actions on the resources, overriding any allows. This changes the policy behavior but not the JSON structure. See execution_table step 3.

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of "Effect" at step 3?

A "Allow"

B "Deny"

C "ListBucket"

D "2012-10-17"

💡 Hint

Check the 'Value Set' column in execution_table row for step 3.

At which step is the resource ARN set in the policy JSON?

A Step 2

B Step 5

C Step 4

D Step 6

💡 Hint

Look for the row where 'Resource' key is processed in execution_table.

If we add another action to the "Action" key as an array, how would the variable 'Statement' change after step 4?

A Action would be a string with one action

B Action would be removed

C Action would be an array with multiple actions

D Statement would be empty

💡 Hint

Refer to variable_tracker for how 'Statement' holds actions.

Concept Snapshot

IAM Policy JSON Structure:
- Start with "Version" key (e.g., "2012-10-17")
- "Statement" is an array of permission blocks
- Each statement has "Effect" (Allow or Deny), "Action" (one or many), and "Resource"
- Optional "Condition" can restrict when policy applies
- Valid JSON structure is required for AWS to accept the policy

Full Transcript

IAM policies in AWS are JSON documents that define permissions. They start with a "Version" key to specify the policy language version. Then, they include a "Statement" array where each statement defines permissions. Each statement must have an "Effect" key that is either "Allow" or "Deny", an "Action" key listing the AWS actions allowed or denied, and a "Resource" key specifying which AWS resources the actions apply to. Optionally, statements can include "Condition" keys to further restrict permissions. The JSON must be valid and follow this structure for AWS to accept and enforce the policy.