What is IAM Policy?

Understanding IAM Policy

An IAM (Identity and Access Management) Policy is a set of rules that defines the permissions associated with user, group, role, or service identities, specifying which actions each identity may perform on which resources and under what conditions. IAM policies are how organizations and cloud platforms translate access decisions into enforceable, machine-readable rules.

A policy typically expresses an effect (allow or deny), the principals it applies to, the actions permitted, the resources targeted, and optional conditions such as source IP, time, or MFA status. In cloud platforms like AWS, policies are written as JSON documents attached to identities or resources, evaluated on every request, where an explicit deny always overrides an allow. On-premises and directory-based systems implement equivalent rules through ACLs, RBAC roles, or group policy. Identity-based policies attach to a principal, while resource-based policies attach to the resource itself.

IAM policies matter because they are the primary control enforcing least privilege: granting each identity only the access it genuinely needs limits the blast radius if credentials are stolen or misused. Overly broad policies, such as wildcard permissions, are a leading cause of cloud breaches and privilege escalation. Well-scoped, regularly reviewed policies reduce attack surface, support separation of duties, and provide an auditable record of who is allowed to do what.

For example, an AWS IAM policy attached to a backup service role allows only the s3:PutObject and s3:GetObject actions, and only on the specific bucket arn:aws:s3:::company-backups, with a condition requiring requests over TLS. If those credentials are leaked, an attacker cannot delete data, touch other buckets, or reach any other AWS service, because the policy permits nothing beyond reading and writing objects in that one bucket.