Access policy builder
Produce a clear starting point for one identity and one resource scope.
# Save this as app-readonly.json, then review it.
aws iam put-role-policy \
+ --role-name application-role \
+ --policy-name app-readonly \
+ --policy-document file://app-readonly.json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "NetOpsTGeneratedPolicy",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::company-data/*"
]
}
]
}Least-privilege checkUse the narrowest identity, scope and permissions possible. Review resource actions and test the policy in a non-production environment before applying it.