AWS IAM Glossary: Core Concepts Explained

The core building blocks of AWS IAM, defined in plain English. Each term has a short page with an example and the most common mistake to avoid. New to IAM risk? See the IAM privilege escalation reference for how these concepts go wrong in practice.

Terms

IAM Trust Policy

A trust policy is the resource-based policy attached to an IAM role that defines which principals are allowed to assume it.

IAM Permissions Boundary

A permissions boundary is an advanced policy that sets the maximum permissions an IAM user or role can ever have, regardless of its attached policies.

Service Control Policy (SCP)

A Service Control Policy is an AWS Organizations policy that sets the maximum available permissions for the accounts it is applied to.

Resource-Based Policy

A resource-based policy is a policy attached directly to a resource (such as an S3 bucket or KMS key) that specifies who can access it and how.

Resource Control Policy (RCP)

A Resource Control Policy is an AWS Organizations policy that sets the maximum available permissions for resource-based policies across accounts in the organization — the resource-side counterpart to a Service Control Policy.

IAM Condition Keys

Condition keys let you add requirements to a policy statement so it only applies when specific context values match — source IP, MFA, account, encryption, and more.

sts:AssumeRole is the STS action that returns temporary security credentials for an IAM role, letting a principal operate with that role’s permissions.

Least Privilege

Least privilege is the principle of granting an identity only the permissions it needs to do its job — nothing more.

IAM Policy Evaluation Logic

IAM policy evaluation is the order in which AWS decides whether a request is allowed: an explicit deny always wins, then an explicit allow, otherwise the default is deny.

IAM Managed Policy

A managed policy is a standalone IAM policy that can be attached to multiple users, groups, or roles, and exists independently of any single identity.

IAM Inline Policy

An inline policy is a policy embedded directly in a single user, group, or role, with a strict one-to-one relationship to that identity.

IAM Session Policy

A session policy is an inline permissions policy passed at the moment a role is assumed, further limiting the permissions of that temporary session.

EC2 Instance Profile

An instance profile is a container for an IAM role that lets an EC2 instance receive temporary credentials for that role automatically.

IAM Service-Linked Role

A service-linked role is a special IAM role that is predefined and owned by an AWS service so the service can perform actions on your behalf.

ExternalId is a shared secret placed in a cross-account role trust policy condition to prevent the confused-deputy problem when a third party assumes your role.

A principal is an entity that can make a request to AWS — an IAM user, an IAM role session, a federated user, or an AWS service acting on your behalf.

Attribute-Based Access Control (ABAC)

ABAC is an authorization model where access is granted based on tags (attributes) on principals and resources rather than on static lists of resource ARNs.

IAM Access Advisor (Last Accessed)

Access Advisor reports the services a principal is allowed to use and when each was last accessed, making it the primary signal for removing unused permissions.

NotAction Element

NotAction matches every action except the ones listed, so it is an inverted action set that is easy to misread as a denial.

Wildcard Action

A wildcard action uses an asterisk to match many or all actions, with Action set to "*" granting every action in AWS.

An access key is a long-lived credential pair (access key ID and secret access key) used to authenticate programmatic requests to AWS as an IAM user.

IAM Multi-Factor Authentication (MFA)

MFA adds a second authentication factor on top of a password or access pattern, so a stolen credential alone is not enough to act.

AWS Account Root User

The root user is the identity created with the AWS account that has unrestricted access to every resource and cannot be limited by IAM policies.

IAM Credential Report

The credential report is an account-level CSV listing every IAM user and the status of their passwords, access keys, and MFA devices.

IAM Policy Simulator

The IAM policy simulator evaluates whether a given principal would be allowed or denied a specific action, without making a real request.

iam:PassRole is the IAM permission that lets a principal hand an existing IAM role to an AWS service, so the service can act as that role.

Confused Deputy Problem

The confused deputy problem is when a more-privileged service can be tricked into using its own permissions to act on a resource the caller should not have access to.

IMDSv2 (Instance Metadata Service v2)

IMDSv2 is the session-oriented, token-required version of the EC2 instance metadata service, designed to make remote theft of an instance role's credentials much harder.

Put it into practice — free

Paste an IAM policy into Shieldly's AI-Powered analyzer and see the risks and fixes in seconds. No signup, no AWS credentials.

Amazon Web Services (AWS) is a trademark of Amazon.com, Inc. Shieldly is not affiliated with, endorsed by, or sponsored by Amazon Web Services.