AWS Security — Comprehensive Reference

IAM

Policy Types (Precedence Order)

1. SCPs (Organizations) — max permissions boundary for entire account
2. Permission boundaries — max permissions for a principal
3. Identity-based policies — attached to user/role/group
4. Resource-based policies — attached to S3, KMS, etc.
5. Session policies — passed at AssumeRole time

Effective permissions = intersection of all applicable allow policies, minus any explicit deny.

Least-Privilege Policy Example