# Policies & Least Privilege — AWS Fundamentals: Core Services for Cloud Beginners

Source: https://www.skillbyai.com/en/aws/aws-iam-policies

> Write JSON IAM policies for allow and deny rules and apply the principle of least privilege.

## Policies at a glance

A **policy** is a JSON document listing allowed or denied actions on resources. Attach it to a user, group, or role, and that identity gains exactly those permissions.

## A minimal policy

This policy allows reading objects from one specific S3 bucket only — nothing else.

```json
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::my-app-bucket/*"
  }]
}
```

Output:

```
Grants read-only access to objects in my-app-bucket
```

## Principle of least privilege

Grant only the permissions an identity **needs, and nothing more**. Start narrow and add access as required — a wide policy today is a bigger blast radius tomorrow.

**Quiz:** What does the principle of least privilege recommend?

- [ ] Give admin access so nothing is ever blocked
- [ ] Never grant any permissions
- [ ] Share the root password
- [x] Grant only the permissions actually needed for the task

*Answer:* Grant only the permissions actually needed for the task. Least privilege minimizes what could go wrong if credentials leak or a mistake happens.