---
title: "AWS IAM resources"
url: https://perrotta.dev/2025/03/aws-iam-resources/
last_updated: 2026-01-03
---


When working on Amazon Web Services (AWS), at some point you'll need to fiddle
with [IAM](https://en.wikipedia.org/wiki/Identity_and_access_management)
(Identity and access management).

It can be daunting to navigate the massive [AWS
Documentation](https://docs.aws.amazon.com/iam/).

I am collecting a couple of useful resources in this post.

## Permissions

https://aws.permissions.cloud/usage:

> The aws.permissions.cloud website uses a variety of information gathered
> within the [IAM Dataset](https://github.com/iann0036/iam-dataset) and exposes
> that information in a clean, easy-to-read format.
>
> aws.permissions.cloud was built in order to provide an alternate,
> community-driven source of truth for AWS identity.
>
> The website can be navigated using the left sidebar or by quickly looking up a
> specific managed policy, IAM permission or API method in the top search bar.

For example, search for "route53" or for "s3".

The main goal of figuring out **permissions** is to add them to a **policy**.

## Policies

https://aws.permissions.cloud/policyevaluator:

Use the Policy Evaluator to validate your [policy
JSON](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_resource.html).

A policy associates permissions (actions) with resources (ARNs).

> Enter your IAM policy in the box below.

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
              "route53:ChangeResourceRecordSets"
            ],
            "Effect": "Allow",
            "Resource": [
              "arn:aws:route53:::hostedzone/01234567890123",
              "arn:aws:route53:::hostedzone/01234567890124"
            ]
        }
    ]
}
```

Each resource above represents a distinct [hosted zone](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-working-with.html):

> A hosted zone is a container for records, and records contain information
> about how you want to route traffic for a specific domain, such as
> example.com, and its subdomains (acme.example.com, zenith.example.com). A
> hosted zone and the corresponding domain have the same name. There are two
> types of hosted zones: public and private.

**Note**: `"Resource"` is singular but it accepts an array of ARNs as well.

**Tip**: Wildcards (`'*'`) are accepted e.g. `"arn:aws:route53:::hostedzone/*"`.

Another example, with S3 buckets:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::*/*"
        }
    ]
}
```

`Action` can be either a single entry or an array.

### Testing

Test out policies and permissions with the [IAM Policy
Simulator](https://policysim.aws.amazon.com/). This service is provided by AWS
itself.
[Docs](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html).

## Terraform

Terraform Registry: [AWS Provider Docs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs).

**Update(2025-09-17)**:

### Roles

Permissions and permissions policies can be associated with roles.

A role is an entity kind that can be _assumed_.

Roles can have trust relationships, which are entities that can assume the role under specified conditions.

For example, it's possible to associate GitHub as a federated web identity provider (IdP) for a given role.