Whenever an AWS IAM entity requests to perform an action, the request context is checked for policies that apply to the request. There are different types of policies that determine whether a certain request is authorized or not. These policies include identity-based policies, resource-based policies, and permissions boundaries. The identity-based policies and permissions boundaries apply to IAM entities. However, resource-based policies apply to resources, defining which entities can access the resource.
In this Cloud Lab, you’ll create an IAM user and attach an identity-based policy to it. You’ll test the effective permissions of the new user by creating an S3 bucket and uploading and deleting files in it through the new user. You’ll then add different permissions boundaries to the new user and test the effective permissions with the same process.
Lastly, you’ll conclude the Cloud Lab by adding a resource-based policy to the S3 bucket we created through the new user and test the effective permissions again through a similar process.
The following is the high-level architecture diagram of the infrastructure you’ll create in this Cloud Lab:
