CyberGuard dictionary / Cloud Security
IAM Policy
An IAM policy is a set of access rules that determines which identities or resources may perform specified actions under specified conditions.
In simple terms
Policies answer who can do what to which cloud resource. Broad permissions can let one compromised account reach unrelated systems.
Technical explanation
In AWS, JSON policy statements describe effects, actions, resources, and optional conditions; effective permission also depends on other applicable policy types and explicit denies. Similar concepts exist across cloud platforms with different syntax.
An IAM policy expresses which principal may perform which actions on which resources, often with conditions. Broad wildcards and inherited permissions can create access that is difficult to see from one policy alone.
Examples in practice
A backup service role is allowed to write to its backup bucket but cannot change billing settings or read customer support records.
A developer role can list storage buckets but should not delete them. A policy review finds an inherited wildcard action and narrows it before production access is granted.
Why it matters
Precise policies support least privilege and limit the damage from a stolen credential.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.