What Is an IAM Policy?

A policy is the JSON document that spells out permissions: which actions, on which resources, are allowed or denied.

Each statement carries an Effect (Allow or Deny), an Action (such as s3:GetObject) and a Resource (which objects it applies to).

AWS provides managed policies for common cases — ReadOnlyAccess, AmazonS3FullAccess — and you can write your own when those don't fit.

A common stumble is reaching for * to make an error go away, granting far more than intended. An explicit Deny always beats an Allow, which is useful for guardrails.

In real work, policies are written to the minimum that the job requires, and reviewed as the job changes.