¬ just serendipity 🍀 (not just serendipity)

When working on Amazon Web Services (AWS), at some point you’ll need to fiddle with IAM (Identity and access management).

It can be daunting to navigate the massive AWS Documentation.

I am collecting a couple of useful resources in this post.

Permissions #

https://aws.permissions.cloud/usage:

The aws.permissions.cloud website uses a variety of information gathered within the IAM Dataset and exposes that information in a clean, easy-to-read format.

aws.permissions.cloud was built in order to provide an alternate, community-driven source of truth for AWS identity.

The website can be navigated using the left sidebar or by quickly looking up a specific managed policy, IAM permission or API method in the top search bar.

For example, search for “route53” or for “s3”.

The main goal of figuring out permissions is to add them to a policy.

Policies #

https://aws.permissions.cloud/policyevaluator:

Use the Policy Evaluator to validate your policy JSON.

A policy associates permissions (actions) with resources (ARNs).

Enter your IAM policy in the box below.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
              "route53:ChangeResourceRecordSets"
            ],
            "Effect": "Allow",
            "Resource": [
              "arn:aws:route53:::hostedzone/01234567890123",
              "arn:aws:route53:::hostedzone/01234567890124"
            ]
        }
    ]
}

Each resource above represents a distinct hosted zone:

A hosted zone is a container for records, and records contain information about how you want to route traffic for a specific domain, such as example.com, and its subdomains (acme.example.com, zenith.example.com). A hosted zone and the corresponding domain have the same name. There are two types of hosted zones: public and private.

Note: "Resource" is singular but it accepts an array of ARNs as well.

Tip: Wildcards ('*') are accepted e.g. "arn:aws:route53:::hostedzone/*".

Another example, with S3 buckets:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::*/*"
        }
    ]
}

Action can be either a single entry or an array.

Testing #

Test out policies and permissions with the IAM Policy Simulator. This service is provided by AWS itself. Docs.

Terraform #

Terraform Registry: AWS Provider Docs.

Update(2025-09-17):

Roles #

Permissions and permissions policies can be associated with roles.

A role is an entity kind that can be assumed.

Roles can have trust relationships, which are entities that can assume the role under specified conditions.

For example, it’s possible to associate GitHub as a federated web identity provider (IdP) for a given role.