Okay, so now let's discuss, IAM policies in depth.
So let's imagine we have a group of developers,
Alice, Bob and Charles, and we,
attach a policy at the group level.
In that case, the policy will get applied
to every single member of the group
so both Alice, Bob, and Charles
they will all get access and inherit this policy.
Now, if you have a second group with operations
with a different policy,
David and Edward will have a different policy
than the group of developers.
If Fred is a user,
it has the possibility not to belong to a group.
And we have the possibility to create what's called
an inline policy which has a policy
that's only attached to a user.
So that user could or could not belong to a group
you can have inline policies for whatever user you want.
And finally, if Charles and David both belong
to the audit team and you attach a policy to the audit team
as well, Charles and David will also inherit
that policy from the audit team.
So in this case, Charles has a policy from developers
and a policy from audit team.
And David has a policy from audit team
and a policy from the operations team.
That should make a lot of sense
when we get into the hands-on.
Now, in terms of the policy structure,
you just need to know at a high level how it works,
as well as how it is named.
So this is something you will see quite a lot in AWS,
so get familiar with this structure
this is adjacent documents.
And so an IAM policy structure, consists of a
version number, so usually it's 2012-10-17,
this is the policy language version.
And ID which is how to identify that policy,
this is optional.
And then more statements,
and statements can be one or multiple ones,
and a statement has some very important parts.
So the Sid is a statement ID, which is an identifier
for the statement, which is optional as well,
so on the right hand side is the number one.
The effect of the policy itself, so it is whether or not
the statement allows or denies access to certain API,
so in the right hand side, this says allow,
but you can see deny as well.
The principle consists of which accounts, user or role
which, to which this policy will be applied to.
So in this example, it's applied to the root accounts
of your AWS accounts.
Action is the list of API calls that will be
either denied or allowed based on the effect.
And the resource is a list of resources,
to which the actions will be applied to.
So in this example, it is a bucket,
but it could be many different things.
And finally in, not represented here
but there's a condition to which when
this statement should be applied or not,
and this is not representative here because it is optional.
So going into the exam, you need to make sure
that you really understand the effect, the principle,
the action and resource, but don't worry,
you will see those along the way in the course
so you should be confident with them
by the end of the course.
That's it for this lecture, I hope you liked it.
And I will see you in the next lecture.