The AWS IAM Mental Model That Finally Makes Policies Click

IAM is the most important AWS service and the least understood. Every security incident I've helped RCA had an IAM misconfiguration somewhere in the chain. The fix isn't memorizing policies — it's internalizing the evaluation model.

The one-sentence model

Every request is denied unless something explicitly allows it — and any explicit deny anywhere wins over every allow. That's it. Everything else is detail.

The evaluation order

• ▸1. Explicit DENY anywhere? → Denied. Stop.
• ▸2. Service Control Policy (Organizations) allows? If not → Denied.
• ▸3. Resource-based policy allows? → Allowed (can be sufficient on its own for same-account).
• ▸4. Identity-based policy allows? → Allowed, unless a permissions boundary or session policy says otherwise.
• ▸5. Nothing allowed it? → Implicit deny.

The pieces people confuse

Identity-based policies attach to users/roles and say what this identity can do. Resource-based policies (S3 bucket policies, SQS queue policies) attach to the resource and say who can touch this resource. Cross-account access always needs the resource side to allow it. Permissions boundaries don't grant anything — they are a ceiling on what identity policies can grant. Same for SCPs at the org level.

Reading a policy like a pro

{
  "Effect": "Allow",
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::my-bucket/*",
  "Condition": {
    "StringEquals": { "aws:PrincipalTag/team": "platform" }
  }
}

Read it as a sentence: allow getting objects from my-bucket, but only if the caller's team tag is platform. Every statement is Effect + Action + Resource + (optional) Condition. When debugging, the IAM Policy Simulator and CloudTrail's errorCode field will tell you which statement matched.

Practical hardening habits

• ▸Roles over users; short-lived credentials over access keys.
• ▸Start from managed policies, then narrow with customer-managed ones.
• ▸Use Access Analyzer to find what's actually unused and cut it.
• ▸Tag-based conditions scale better than resource ARN lists.