AWS CloudFormation IAM - Reference
This reference guide contains detailed information about AWS CloudFormation resources, intrinsic functions, and configurations for IAM infrastructure.
AWS::IAM::User
Creates an IAM user for your AWS account.
Properties
| Property |
Type |
Required |
Description |
| UserName |
String |
Yes |
The name of the user |
| Path |
String |
No |
The path for the user name |
| Groups |
List of String |
No |
A list of group names to associate with the user |
| ManagedPolicyArns |
List of String |
No |
A list of managed policy ARNs to attach to the user |
| PermissionsBoundary |
String |
No |
The ARN of the policy used to set the permissions boundary |
| Policies |
List of Policy |
No |
A list of embedded policies to attach to the user |
| Tags |
List of Tag |
No |
A list of tags to attach to the user |
Policy Structure
Policy:
PolicyName: String
PolicyDocument: PolicyDocument
PolicyDocument Structure
PolicyDocument:
Version: String
Statement: List of Statement
Statement Structure
Statement:
- Sid: String
Effect: String
Principal: Principal
NotPrincipal: Principal
Action: List of String or String
NotAction: List of String or String
Resource: List of String or String
NotResource: List of String or String
Condition: Condition
Example
Resources:
AppUser:
Type: AWS::IAM::User
Properties:
UserName: !Sub "${AWS::StackName}-app-user"
Path: /applications/
Groups:
- !Ref AppUserGroup
ManagedPolicyArns:
- arn:aws:iam::aws:policy/ReadOnlyAccess
Policies:
- PolicyName: !Sub "${AWS::StackName}-custom-policy"
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- s3:GetObject
- s3:ListBucket
Resource:
- !Ref DataBucketArn
- !Sub "${DataBucketArn}/*"
Tags:
- Key: Environment
Value: !Ref Environment
Attributes
| Attribute |
Description |
| Arn |
The ARN of the user |
| UserId |
The unique identifier for the user |
AWS::IAM::Role
Creates an IAM role that you can assume to delegate permissions.
Properties
| Property |
Type |
Required |
Description |
| RoleName |
String |
No |
The name of the role |
| AssumeRolePolicyDocument |
PolicyDocument |
Yes |
The policy that grants an entity permission to assume the role |
| ManagedPolicyArns |
List of String |
No |
A list of managed policy ARNs to attach to the role |
| MaxSessionDuration |
Integer |
No |
The maximum session duration in seconds (900-43200) |
| PermissionsBoundary |
String |
No |
The ARN of the policy used to set the permissions boundary |
| Policies |
List of Policy |
No |
A list of embedded policies to attach to the role |
| Description |
String |
No |
A description for the role |
| Tags |
List of Tag |
No |
A list of tags to attach to the role |
Principal Types
Principal:
Service: List of String or String
AWS: List of String or String
Federated: List of String or String
Example with Service Principal
Resources:
LambdaExecutionRole:
Type: AWS::IAM::Role
Properties:
RoleName: !Sub "${AWS::StackName}-lambda-role"
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
Service: lambda.amazonaws.com
Action: sts:AssumeRole
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
MaxSessionDuration: 3600
Policies:
- PolicyName: !Sub "${AWS::StackName}-dynamodb-policy"
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- dynamodb:GetItem
- dynamodb:PutItem
Resource: !GetAtt DataTable.Arn
Example with AWS Principal
Resources:
CrossAccountRole:
Type: AWS::IAM::Role
Properties:
RoleName: !Sub "${AWS::StackName}-crossaccount"
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
AWS: !Sub "arn:aws:iam::${SourceAccountId}:root"
Action: sts:AssumeRole
Condition:
StringEquals:
sts:Externalid: !Ref ExternalId
Policies:
- PolicyName: ReadOnly
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- s3:GetObject
- s3:ListBucket
Resource: "*"
Attributes
| Attribute |
Description |
| Arn |
The ARN of the role |
| RoleId |
The unique identifier for the role |
AWS::IAM::Policy
Creates an IAM policy for an IAM user, group, or role.
Properties
| Property |
Type |
Required |
Description |
| PolicyName |
String |
Yes |
The name of the policy |
| Groups |
List of String |
No |
A list of group names to attach the policy to |
| Roles |
List of String |
No |
A list of role names to attach the policy to |
| Users |
List of String |
No |
A list of user names to attach the policy to |
| ManagedPolicyArns |
List of String |
No |
A list of additional managed policy ARNs to attach |
| PolicyDocument |
PolicyDocument |
Yes |
The policy document |
Example
Resources:
S3ReadPolicy:
Type: AWS::IAM::Policy
Properties:
PolicyName: !Sub "${AWS::StackName}-s3-read"
Groups:
- !Ref ReadOnlyGroup
Roles:
- !Ref ReadOnlyRole
Users:
- !Ref ReadOnlyUser
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- s3:GetObject
- s3:GetObjectVersion
- s3:ListBucket
Resource:
- !Ref DataBucketArn
- !Sub "${DataBucketArn}/*"
Attributes
| Attribute |
Description |
| Arn |
The ARN of the policy |
AWS::IAM::ManagedPolicy
Creates a managed policy that you can attach to multiple users, groups, or roles.
Properties
| Property |
Type |
Required |
Description |
| ManagedPolicyName |
String |
No |
The name of the managed policy |
| Description |
String |
No |
A description of the managed policy |
| Path |
String |
No |
The path for the policy name |
| Groups |
List of String |
No |
A list of group names to attach the policy to |
| Roles |
List of String |
No |
A list of role names to attach the policy to |
| Users |
List of String |
No |
A list of user names to attach the policy to |
| PolicyDocument |
PolicyDocument |
Yes |
The policy document |
Example
Resources:
CustomReadOnlyPolicy:
Type: AWS::IAM::ManagedPolicy
Properties:
ManagedPolicyName: !Sub "${AWS::StackName}-custom-readonly"
Description: Custom read-only access policy
Path: /custom/
Groups:
- !Ref AppGroup
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- s3:Get*
- s3:List*
Resource: "*"
- Effect: Allow
Action:
- dynamodb:Get*
- dynamodb:Query
- dynamodb:Scan
Resource: "*"
Attributes
| Attribute |
Description |
| Arn |
The ARN of the managed policy |
AWS::IAM::UserLoginProfile
Creates a password for an IAM user. The password allows access to the AWS Management Console.
Properties
| Property |
Type |
Required |
Description |
| UserName |
String |
Yes |
The name of the IAM user |
| Password |
String |
No |
The password for the IAM user |
| PasswordResetRequired |
Boolean |
No |
Whether the user is required to reset their password |
Example
Resources:
ConsoleUser:
Type: AWS::IAM::User
Properties:
UserName: !Sub "${AWS::StackName}-console-user"
UserLoginProfile:
Type: AWS::IAM::UserLoginProfile
Properties:
UserName: !Ref ConsoleUser
Password: !Ref InitialPassword
PasswordResetRequired: true
AWS::IAM::AccessKey
Creates an access key and secret key for an IAM user.
Properties
| Property |
Type |
Required |
Description |
| UserName |
String |
Yes |
The name of the IAM user |
| Status |
String |
No |
The status of the access key (Active or Inactive) |
| Serial |
Integer |
No |
The serial number for the access key |
Example
Resources:
AppUser:
Type: AWS::IAM::User
Properties:
UserName: !Sub "${AWS::StackName}-app-user"
UserAccessKey:
Type: AWS::IAM::AccessKey
Properties:
UserName: !Ref AppUser
Status: Active
Serial: 1
UserSecret:
Type: AWS::SecretsManager::Secret
Properties:
Name: !Sub "${AWS::StackName}/credentials"
SecretString: !Sub |
{
"access_key": "${UserAccessKey.Ref}",
"secret_key": "{{resolve:secretsmanager:${UserAccessKey.SecretAccessKey}}}"
}
Attributes
| Attribute |
Description |
| SecretAccessKey |
The secret key for the access key |
| Ref |
The access key ID |
AWS::IAM::InstanceProfile
Creates an instance profile that can be used to pass an IAM role to an EC2 instance.
Properties
| Property |
Type |
Required |
Description |
| InstanceProfileName |
String |
No |
The name of the instance profile |
| Roles |
List of String |
Yes |
A list of role names to associate with the instance profile |
| Path |
String |
No |
The path for the instance profile name |
Example
Resources:
EC2Role:
Type: AWS::IAM::Role
Properties:
RoleName: !Sub "${AWS::StackName}-ec2-role"
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
Service: ec2.amazonaws.com
Action: sts:AssumeRole
ManagedPolicyArns:
- arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
EC2InstanceProfile:
Type: AWS::IAM::InstanceProfile
Properties:
InstanceProfileName: !Sub "${AWS::StackName}-profile"
Roles:
- !Ref EC2Role
EC2Instance:
Type: AWS::EC2::Instance
Properties:
InstanceType: t3.micro
IamInstanceProfile: !Ref EC2InstanceProfile
Attributes
| Attribute |
Description |
| Arn |
The ARN of the instance profile |
AWS::IAM::UserToGroupAddition
Adds an IAM user to an IAM group.
Properties
| Property |
Type |
Required |
Description |
| GroupName |
String |
Yes |
The name of the group |
| Users |
List of String |
Yes |
A list of user names to add to the group |
Example
Resources:
DevelopersGroup:
Type: AWS::IAM::Group
Properties:
GroupName: !Sub "${AWS::StackName}-developers"
ManagedPolicyArns:
- arn:aws:iam::aws:policy/ReadOnlyAccess
AppUser:
Type: AWS::IAM::User
Properties:
UserName: !Sub "${AWS::StackName}-developer"
UserGroupMembership:
Type: AWS::IAM::UserToGroupAddition
Properties:
GroupName: !Ref DevelopersGroup
Users:
- !Ref AppUser
- !Ref AnotherUser
AWS::IAM::ServerCertificate
Uploads a server certificate and saves it in IAM.
Properties
| Property |
Type |
Required |
Description |
| ServerCertificateName |
String |
No |
The name for the server certificate |
| CertificateBody |
String |
Yes |
The certificate body |
| PrivateKey |
String |
Yes |
The private key |
| CertificateChain |
String |
No |
The certificate chain |
| Path |
String |
No |
The path for the server certificate |
Example
Resources:
SSLCertificate:
Type: AWS::IAM::ServerCertificate
Properties:
ServerCertificateName: !Sub "${AWS::StackName}-ssl-cert"
CertificateBody: |
-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIJAJC1HiIAZAiUMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
BAYTAlVTMRUwEwYDVQQIDAxDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNp
c2NvMRAwDgYDVQQKDAdFeGFtcGxlMRswGQYJKoZIhvcNAQkBFgx1c2VyQGV4YW1w
bGUuY29tMB4XDTIzMDEwMTAwMDAwMFoXDTI0MDEwMTAwMDAwMFowRTELMAkGA1UE
BhMCVVMxFTATBgNVBAgMDENhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lz
Y28xEDAOBgNVBAoMB0V4YW1wbGUxGzAZBgkqhkiG9w0BCQEWDHVzZXJAZXhhbXBs
ZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7fRXEe2x0qJqx
hE4GjKqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJ
DeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG
8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJ
DeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG
8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJ
AgMBAAGjUzBRMB0GA1UdDgQWBBTBBXcvR1q3c1B1jZfYvLrYQ5GfAfGA8wDgYD
VR0PAQH/BAQDAgeAMBMGA1UdIwQMMAoECE31k7i4q5+rMA0GCSqGSIb3DQEBCwUA
A4IBAQCk0pHvp8pwh3hUBDqK3x2j5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5
V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9
w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w
3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3
d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d
-----END CERTIFICATE-----
PrivateKey: |
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEA0Z3VS5JJcds3xfn/ygWyF8h+3hY0J8dC4a4b4e8c9f0e1d2
c3b4a5d6e7f8g9h0i1j2k3l4m5n6o7p8q9r0s1t2u3v4w5x6y7z8A9B0C1D2E3
F4G5H6I7J8K9L0M1N2O3P4Q5R6S7T8U9V0W1X2Y3Z4A5B6C7D8E9F0G1H2I3J4
K5L6M7N8O9P0Q1R2S3T4U5V6W7X8Y9Z0A1B2C3D4E5F6G7H8I9J0K1L2M3N4O5
P6Q7R8S9T0U1V2W3X4Y5Z6A7B8C9D0E1F2G3H4I5J6K7L8M9N0O1P2Q3R4S5T6
U7V8W9X0Y1Z2A3B4C5D6E7F8G9H0I1J2K3L4M5N6O7P8Q9R0S1T2U3V4W5X6Y7
Z8A9B0C1D2E3F4G5H6I7J8K9L0M1N2O3P4Q5R6S7T8U9V0W1X2Y3Z4A5B6C7D8
E9F0G1H2I3J4K5L6M7N8O9P0Q1R2S3T4U5V6W7X8Y9Z0A1B2C3D4E5F6G7H8I9
J0K1L2M3N4O5P6Q7R8S9T0U1V2W3X4Y5Z6A7B8C9D0E1F2G3H4I5J6K7L8M9N0
O1P2Q3R4S5T6U7V8W9X0Y1Z2A3B4C5D6E7F8G9H0I1J2K3L4M5N6O7P8Q9R0S1
-----END RSA PRIVATE KEY-----
CertificateChain: |
-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIJAJC1HiIAZAiUMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
BAYTAlVTMRUwEwYDVQQIDAxDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNp
c2NvMRAwDgYDVQQKDAdFeGFtcGxlMRswGQYJKoZIhvcNAQkBFgx1c2VyQGV4YW1w
bGUuY29tMB4XDTIzMDEwMTAwMDAwMFoXDTI0MDEwMTAwMDAwMFowRTELMAkGA1UE
BhMCVVMxFTATBgNVBAgMDENhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lz
Y28xEDAOBgNVBAoMB0V4YW1wbGUxGzAZBgkqhkiG9w0BCQEWDHVzZXJAZXhhbXBs
ZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7fRXEe2x0qJqx
hE4GjKqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJ
DeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG
8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJ
DeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG
8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJ
AgMBAAGjUzBRMB0GA1UdDgQWBBTBBXcvR1q3c1B1jZfYvLrYQ5GfAfGA8wDgYD
VR0PAQH/BAQDAgeAMBMGA1UdIwQMMAoECE31k7i4q5+rMA0GCSqGSIb3DQEBCwUA
A4IBAQCk0pHvp8pwh3hUBDqK3x2j5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5
V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9
w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w
3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3
d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d
-----END CERTIFICATE-----
Attributes
| Attribute |
Description |
| Arn |
The ARN of the server certificate |
AWS::Organizations::Policy
Creates a policy in an organization or in an organizational unit.
Properties
| Property |
Type |
Required |
Description |
| Name |
String |
Yes |
The name of the policy |
| Description |
String |
No |
A description of the policy |
| Type |
String |
Yes |
The type of policy (SERVICE_CONTROL_POLICY, TAG_POLICY, BACKUP_POLICY, AI_SERVICES_OPT_OUT_POLICY) |
| Content |
JSON |
Yes |
The policy content as JSON |
| TargetIds |
List of String |
No |
A list of organizational unit IDs or account IDs to attach the policy to |
Example with SCP
Resources:
RestrictiveSCP:
Type: AWS::Organizations::Policy
Properties:
Name: !Sub "${AWS::StackName}-restrictive"
Description: SCP to restrict dangerous operations
Type: SERVICE_CONTROL_POLICY
Content:
Version: "2012-10-17"
Statement:
- Sid: DenyDeleteProduction
Effect: Deny
Action:
- s3:DeleteBucket
- dynamodb:DeleteTable
- rds:DeleteDBInstance
Resource: "*"
Condition:
StringEquals:
aws:ResourceTag/environment: production
- Sid: RequireEncryption
Effect: Deny
Action:
- s3:PutObject
Resource: "*"
Condition:
StringNotEquals:
s3:x-amz-server-side-encryption: AES256
AWS::SSO::PermissionSet
Creates a permission set that you can assign to your workforce identities.
Properties
| Property |
Type |
Required |
Description |
| InstanceArn |
String |
Yes |
The ARN of the SSO instance |
| PermissionSetName |
String |
Yes |
The name of the permission set |
| Description |
String |
No |
A description of the permission set |
| SessionDuration |
String |
No |
The duration of the session (ISO 8601 duration format) |
| RelayStateType |
String |
No |
The relay state URL |
| ManagedPolicies |
List of String |
No |
A list of managed policy ARNs |
| InlinePolicy |
String |
No |
An inline policy document |
Example
Resources:
AdminPermissionSet:
Type: AWS::SSO::PermissionSet
Properties:
InstanceArn: !Ref SSOInstanceArn
PermissionSetName: !Sub "${AWS::StackName}-admin"
Description: Administrator access permission set
SessionDuration: PT8H
ManagedPolicies:
- arn:aws:iam::aws:policy/AdministratorAccess
InlinePolicy: |
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["aws-portal:*Billing"],
"Resource": "*"
}
]
}
Attributes
| Attribute |
Description |
| PermissionSetArn |
The ARN of the permission set |
AWS::SSO::AccountAssignment
Assigns access to a principal in a specific AWS account using a permission set.
Properties
| Property |
Type |
Required |
Description |
| InstanceArn |
String |
Yes |
The ARN of the SSO instance |
| PermissionSetArn |
String |
Yes |
The ARN of the permission set |
| PrincipalId |
String |
Yes |
The ID of the principal |
| PrincipalType |
String |
Yes |
The type of principal (USER or GROUP) |
| TargetId |
String |
Yes |
The ID of the AWS account |
| TargetType |
String |
Yes |
The type of target (AWS_ACCOUNT) |
Example
Resources:
AdminPermissionSet:
Type: AWS::SSO::PermissionSet
Properties:
InstanceArn: !Ref SSOInstanceArn
PermissionSetName: !Sub "${AWS::StackName}-admin"
ManagedPolicies:
- arn:aws:iam::aws:policy/AdministratorAccess
AdminAssignment:
Type: AWS::SSO::AccountAssignment
Properties:
InstanceArn: !Ref SSOInstanceArn
PermissionSetArn: !Ref AdminPermissionSet.PermissionSetArn
PrincipalId: !Ref AdminGroupId
PrincipalType: GROUP
TargetId: !Ref TargetAccountId
TargetType: AWS_ACCOUNT
AWS::IAM::ServiceLinkedRole
Creates an IAM service-linked role for an AWS service.
Properties
| Property |
Type |
Required |
Description |
| AWSServiceName |
String |
Yes |
The service name for which the role is created |
| Description |
String |
No |
A description of the role |
| CustomSuffix |
String |
No |
A custom suffix for the role name |
| SupportedServices |
List of String |
No |
A list of services that can assume the role |
Example
Resources:
AutoScalingServiceRole:
Type: AWS::IAM::ServiceLinkedRole
Properties:
AWSServiceName: autoscaling.amazonaws.com
Description: Service-linked role for Auto Scaling
CustomSuffix: auto-scaling
AWS::IAM::SAMLProvider
Creates an IAM SAML identity provider.
Properties
| Property |
Type |
Required |
Description |
| SAMLMetadataDocument |
String |
Yes |
The XML metadata document |
| Name |
String |
No |
The name of the SAML provider |
Example
Resources:
SAMLProvider:
Type: AWS::IAM::SAMLProvider
Properties:
Name: !Sub "${AWS::StackName}-saml"
SAMLMetadataDocument: !Ref MetadataDocument
Attributes
| Attribute |
Description |
| Arn |
The ARN of the SAML provider |
AWS::IAM::OIDCProvider
Creates an IAM OpenID Connect provider.
Properties
| Property |
Type |
Required |
Description |
| Url |
String |
Yes |
The URL for the OIDC provider |
| ClientIdList |
List of String |
No |
A list of client IDs |
| ThumbprintList |
List of String |
No |
A list of thumbprints |
| Tags |
List of Tag |
No |
A list of tags to attach |
Example
Resources:
OIDCProvider:
Type: AWS::IAM::OIDCProvider
Properties:
Url: !Sub "https://${OidcProviderEndpoint}"
ClientIdList:
- !Ref ClientId
ThumbprintList:
- !Ref Thumbprint
Condition Keys Reference
AWS-Specific Condition Keys
| Condition Key |
Type |
Description |
| aws:SourceIp |
IP address |
Source IP address of the requester |
| aws:RequestedRegion |
String |
AWS region requested |
| aws:ResourceTag/tag-key |
String |
Tag value on the resource |
| aws:PrincipalTag/tag-key |
String |
Tag value on the principal |
| aws:MultiFactorAuthPresent |
Boolean |
Whether MFA was used |
| aws:MultiFactorAuthAge |
Numeric |
Age of the MFA session |
| aws:EpochTime |
Numeric |
Time of the request |
| aws:CurrentTime |
Date |
Current time |
| aws:SecureTransport |
Boolean |
Whether SSL was used |
S3-Specific Condition Keys
| Condition Key |
Type |
Description |
| s3:prefix |
String |
Prefix for ListBucket |
| s3:Delimiter |
String |
Delimiter for ListBucket |
| s3:x-amz-server-side-encryption |
String |
Server-side encryption algorithm |
| s3:x-amz-acl |
String |
Access control list |
| s3:ExistingObjectTag/tag-key |
String |
Tag on existing object |
| s3:RequestObjectTag/tag-key |
String |
Tag on object being uploaded |
DynamoDB-Specific Condition Keys
| Condition Key |
Type |
Description |
| dynamodb:TableName |
String |
Name of the table |
| dynamodb:Select |
String |
Select type |
| dynamodb:Attributes |
List |
Attributes to return |
| dynamodb:ReturnValues |
String |
Return values type |
| dynamodb:QueryFilter |
Map |
Query filter conditions |
IAM-Specific Condition Keys
| Condition Key |
Type |
Description |
| iam:ResourceTag/tag-key |
String |
Tag on IAM resource |
| iam:PrincipalTag/tag-key |
String |
Tag on principal |
| iam:AWSServiceName |
String |
Service name for service roles |
| sts:Externalid |
String |
External ID for role assumption |
| sts:SourceIdentity |
String |
Source identity |
KMS-Specific Condition Keys
| Condition Key |
Type |
Description |
| kms:EncryptionContext:key |
String |
Encryption context |
| kms:ViaService |
String |
Service that can use the key |
| kms:GrantConstraintType |
String |
Type of grant constraint |
| kms:GrantOperations |
List |
Operations allowed by grant |
Intrinsic Functions
Fn::GetAtt
Returns the value of an attribute from a resource.
RoleArn: !GetAtt MyRole.Arn
RoleId: !GetAtt MyRole.RoleId
UserArn: !GetAtt MyUser.Arn
Ref
Returns the value of the specified parameter or resource.
UserName: !Ref MyUser
RoleName: !Ref MyRole
Fn::Sub
Substitutes variables in an input string.
RoleArn: !Sub "arn:aws:iam::${AWS::AccountId}:role/${RoleName}"
PolicyDocument: !Sub |
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::${BucketName}/*"
}]
}
Fn::Join
Concatenates values into a single string.
ResourceArns: !Join
- ","
- - !GetAtt Table1.Arn
- !GetAtt Table2.Arn
Fn::Select
Returns a single object from a list.
FirstRoleArn: !Select [0, !Ref RoleArns]
Condition Functions
# Fn::If
PermissionsBoundary: !If
- HasBoundary
- !Ref BoundaryPolicyArn
- !Ref AWS::NoValue
# Fn::Equals
IsProduction: !Equals [!Ref Environment, production]
# Fn::Not
IsNotDev: !Not [!Equals [!Ref Environment, dev]]
# Fn::And
IsProdAndLarge: !And
- !Equals [!Ref Environment, production]
- !Equals [!Ref InstanceSize, large]
# Fn::Or
IsDevOrStaging: !Or
- !Equals [!Ref Environment, dev]
- !Equals [!Ref Environment, staging]
Common AWS Managed Policies
Lambda Execution
| Policy ARN |
Description |
| arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole |
Basic Lambda execution with CloudWatch Logs |
| arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole |
Lambda VPC network access |
| arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole |
Lambda SQS polling |
| arn:aws:iam::aws:policy/service-role/AWSLambdaKinesisExecutionRole |
Lambda Kinesis streaming |
EC2
| Policy ARN |
Description |
| arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore |
SSM agent access |
| arn:aws:iam::aws:policy/AmazonSSMFullAccess |
Full SSM access |
| arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess |
EC2 read-only access |
| arn:aws:iam::aws:policy/AmazonEC2FullAccess |
Full EC2 access |
S3
| Policy ARN |
Description |
| arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess |
S3 read-only access |
| arn:aws:iam::aws:policy/AmazonS3FullAccess |
Full S3 access |
| arn:aws:iam::aws:policy/AmazonS3ObjectReadOnlyAccess |
S3 object read-only |
Database
| Policy ARN |
Description |
| arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess |
DynamoDB read-only |
| arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess |
Full DynamoDB |
| arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess |
RDS read-only |
| arn:aws:iam::aws:policy/AmazonRDSFullAccess |
Full RDS |
Read-Only and Security
| Policy ARN |
Description |
| arn:aws:iam::aws:policy/ReadOnlyAccess |
All read-only access |
| arn:aws:iam::aws:policy/SecurityAudit |
Security audit access |
| arn:aws:iam::aws:policy/ViewBilling |
View billing information |
Container
| Policy ARN |
Description |
| arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy |
ECS task execution |
| arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy |
EKS worker nodes |
| arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy |
EKS CNI plugin |
| arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly |
ECR read-only |
Limits and Quotas
IAM Limits
| Resource |
Default Limit |
| Users per account |
5000 |
| Groups per account |
300 |
| Roles per account |
1000 |
| Policies per account |
1500 |
| Access keys per user |
2 |
| Managed policies attached to role/user/group |
10 |
| Size of inline policy |
10240 characters |
| Size of managed policy |
6144 characters |
| Session duration (roles) |
1-12 hours |
Policy Document Limits
| Element |
Limit |
| Statements per policy |
10 |
| Characters per policy document |
10240 |
| Actions per statement |
100 |
| Resources per statement |
100 |
| Condition keys per statement |
10 |
Error Handling
Common Errors
| Error |
Cause |
Solution |
| AccessDenied |
Insufficient permissions |
Add required actions to policy |
| MalformedPolicyDocument |
Invalid policy syntax |
Validate JSON syntax |
| ValidationError |
Invalid parameter value |
Check parameter constraints |
| LimitExceeded |
Resource limit reached |
Request increase or clean up |
| NoSuchEntity |
Resource not found |
Verify resource name/ARN |
| ServiceFailure |
AWS service error |
Retry with backoff |
Validation Tools
# Validate template
aws cloudformation validate-template --template-body file://template.yaml
# Check for IAM issues
aws iam get-account-password-policy
aws iam get-account-summary
Best Practices Reference
Policy Writing
- Use least privilege: Start restrictive, add permissions as needed
- Use wildcards sparingly: Prefer specific actions
- Use conditions: Restrict by IP, time, tags
- Use resource-level restrictions: Specify ARNs when possible
- Use separate policies: Easier to audit and modify
- Version policies: Use "2012-10-17" version
Role Configuration
- Trust relationships: Limit to required principals
- Session duration: Set based on use case
- Permissions boundary: Prevent privilege escalation
- External ID: Use for cross-account access
- Conditions: Add IP and MFA requirements
Security Recommendations
- Enable MFA for all users
- Rotate access keys regularly
- Use roles instead of long-term credentials
- Delete unused users and access keys
- Review policies quarterly
- Use CloudTrail for audit logging
- Enable IAM Access Analyzer
tools-only