Utkarsh Rastogi for AWS Community Builders

Posted on Jun 15 • Edited on Jun 21

📘 AWS IAM Explained Desi-Style — With Hall Passes, Boundaries & Principal’s Final Word! (Part 2)

#aws #iam #cloudsecurity #leastprivilege

🎒 Welcome back to the IAM School Series!

In Part 1, we decoded IAM with fun school analogies:

👨‍🏫 IAM = Principal
👩‍🎓 Users = Students
🎫 Policies = Hall Passes
🧪 AWS Services = Classrooms

This time, we dive into the hidden layers of IAM — Permission Boundaries, Inline Policies, and the all-powerful Explicit Deny — the final word from your school's Principal! 🏫

🚪 Part 2: “Hall Pass Hai, Par Boundary Ke Bahar Nahi Ja Sakta!”

Ever had this moment?

“Policy mein allow hai, phir bhi access denied aa raha hai?”

Welcome to the world of:

✅ Managed vs Inline Policies
🚧 Permission Boundaries
⛔ Explicit Deny overrides all

Let’s understand it Desi-Style! 🇮🇳

🧱 IAM Policy Types — The School Way

IAM Concept	School Analogy	Purpose
Managed Policy	Official Hall Pass Booklet	Reusable permission sets for many users
Inline Policy	Note from Class Teacher	Custom permission for one specific student
Permission Boundary	Principal’s Fence Rule	Max area a student can operate in
Explicit Deny	Rulebook says “Strictly Prohibited”	Overrides any permission

🏫 School Example 1: The Curious Student and The Lab Room

👨‍🎓 Utkarsh, a science student, receives:

📝 An Inline Policy from the Chemistry Teacher:

"Utkarsh can access the Chemistry Lab anytime."
🚧 But the Principal’s Boundary Rule says:

"No one is allowed in labs after 5 PM."

🕔 Utkarsh tries to enter the lab at 5:30 PM.

🚫 Access Denied!

Even with permission, the boundary overrides it.

💻 Real AWS Example 1: EC2 Access Blocked by Boundary

IAM User: dev-user

✅ User Policy:

{
  "Effect": "Allow",
  "Action": "ec2:StartInstances",
  "Resource": "*"
}

❌ Permission Boundary:

{
  "Effect": "Allow",
  "Action": "s3:*",
  "Resource": "*"
}

🔐 Result:

Even though the user has EC2 access in their policy, the boundary allows only S3 actions.

🧱 Boundary is the boss! 🔒

🏫 School Example 2: Guest Lecturer Blocked by Rules

👨‍🏫 Mr. Sharma (a guest lecturer) has:

🏛️ A visitor pass signed by the Principal (Trust Policy)
🧾 Permission from the subject teacher to teach in Room 7B (Permissions Policy)

But the Rulebook says:

"No guest lecturers allowed during exam week."

❌ Result: Access Denied

⛔ Explicit Deny wins — always!

💻 Real AWS Example 2: Lambda + Trust + Deny

🛂 Trust Policy (Allows Role Assumption):

{
  "Effect": "Allow",
  "Principal": {
    "Service": "lambda.amazonaws.com"
  },
  "Action": "sts:AssumeRole"
}

✅ Permissions Policy:

{
  "Effect": "Allow",
  "Action": "dynamodb:PutItem",
  "Resource": "arn:aws:dynamodb:<Region>:<AccountID>:table/StudentData"
}

❌ Explicit Deny:

{
  "Effect": "Deny",
  "Action": "dynamodb:*",
  "Resource": "*"
}

🔐 Result:

Access denied — even though permissions exist — because explicit deny overrides all.

🧾 Inline vs Managed — Who Gets What?

Policy Type	School Analogy	Best Use Case
Managed Policy	Printed Hall Pass for all Sports Students	Reusable across teams or departments
Inline Policy	Special Note: "Only Utkarsh can use Art Room"	Unique, user-specific scenarios

🏫 School Example 3: Project Day Chaos

🧑‍🎓 Aman wants to access the Computer Lab.

✅ Has Managed Policy: "Can access all labs"
✅ Has Inline Policy: "Access only to Computer Lab"
❌ Principal sets Boundary: "Only Bio students allowed in labs today"

🔐 Result: ❌ Access Denied

Boundary wins over all other permissions.

💻 Real AWS Example 3: S3 Uploads Within Boundaries

IAM User: awslearner

📝 Inline Policy:

{
  "Effect": "Allow",
  "Action": "s3:PutObject",
  "Resource": "arn:aws:s3:::project-submissions/*"
}

🚧 Permission Boundary:

{
  "Effect": "Allow",
  "Action": "s3:PutObject",
  "Resource": "arn:aws:s3:::project-submissions/*"
}

✅ Access works

Because the action is allowed in both the user policy and the permission boundary.

❗ But if the user tried s3:DeleteObject, it would be denied, as it's not included in the boundary.

🧠 IAM Evaluation Flow — Principal Ki Marzi

✅ Check user’s policies — is action allowed?
✅ Is it within permission boundary?
❌ Any explicit deny?
✅ Final result = All above must match ✅

📌 IAM is AND logic — all doors must open.

🎓 Summary — IAM Isn’t Just Hall Passes

IAM Element	School Equivalent	Notes
Policy (Managed/Inline)	Hall Pass / Teacher Note	Grants permission
Permission Boundary	Principal’s Area Restriction	Sets max what a user can ever do
Explicit Deny	Rulebook with “No Exceptions”	Overrides every Allow