AWS IAM Policy Evaluation Logic & Access Controls

AWS IAM (Identity and Access Management) controls access to AWS resources. Principals are entities that can make requests: root users, IAM users, federated federations, or assumed IAM Roles.

When a principal makes an API request (like listing S3 buckets), AWS authenticates the request using access keys or STS session tokens, checking signature credentials before starting policy evaluations.

AWS IAM evaluates all policies associated with a request context. The evaluation engine applies a strict hierarchy:

1. Explicit Deny: If any policy matches the request with an explicit `Deny` statement, the evaluation halts immediately, denying access. Deny always wins.

2. Organizations SCPs: Service Control Policies enforce boundaries on member accounts.

3. Permissions Boundaries: Restricts maximum access permissions.

4. Explicit Allow: The request must match an explicit `Allow` statement in an identity-based or resource-based policy to proceed.

5. Implicit Deny: If there is no explicit `Allow`, the request is denied by default.

An IAM Role is an identity with permission policies that can be assumed by anyone who needs it (users, EC2 instances, AWS Lambda functions). Unlike users, roles do not have credentials like passwords or keys.

Instead, a role requires a Trust Relationship Policy, specifying which external principal is authorized to assume the role. When assumed, AWS Security Token Service (STS) returns temporary credentials valid for a specified window (typically 1 to 12 hours).