More detail
Each statement has an Effect (Allow or Deny), Actions (like dynamodb:PutItem) and Resources (ARNs). An explicit Deny always beats an Allow.
IAM policy
A JSON document listing allowed (or denied) actions on resources.
Think of it as: The list of rooms printed on the back of a badge.
What to know for Level 0
- An explicit Deny anywhere (an IAM policy, a resource policy or an SCP) always beats any number of Allows. Which policy is more specific doesn't matter.
- An identity-based policy is attached to a user, group or role and says what they may do. A resource-based policy is attached to a resource (a Lambda function, an S3 bucket, an SQS queue) and names who may use it.
- Least privilege: allow only the actions a job needs, only on the resources (by ARN) it uses. Avoid
*. - An AccessDenied error means no policy allowed the call, so fix the caller's policy. A network problem looks different: it times out.