Demo Identity Policy

In this tutorial, you’ll learn how to create a custom IAM identity policy in AWS, attach it to a user group, and then refine its permissions using both the Visual editor and the JSON editor. By the end, you’ll have a policy that grants S3 read access, full EC2 permissions, and explicitly denies the ability to stop EC2 instances.

1. Create a Developers Group

1. In the AWS Management Console, navigate to IAM → User groups.
2. Click Create group, name it Developers, and add the user John to the group.
3. Skip attaching any policies for now and finish the wizard.

Once created, you’ll see Developers listed without any permissions:

2. Create a Custom Policy

1. In the IAM sidebar, select Policies.
2. Click Create policy.

2.1 Grant S3 Read Access

• Under Service, choose S3.
• In Actions, expand Read and check GetObject.
• Under Resources → Add ARN, enter:
  • Bucket: company1-sales
  • Object: *
    The console will build the ARN for you.

2.2 Grant EC2 Full Access

• Click Add permissions → EC2.
• Select All EC2 actions under Actions.
• Leave the resource set to * for all instances.

2.3 Review, Name, and Create

1. Click Next until you reach Review policy.
2. Set Name to Developers_Policy and add an optional description.
3. Click Create policy.

3. Attach Policy to the Developers Group

1. Return to IAM → User groups.
2. Select Developers.
3. Under the Permissions tab, click Attach policies.
4. Search for and select Developers_Policy, then click Attach policy.

Once attached, you can click the JSON icon to inspect the policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": "ec2:*",
      "Resource": "*"
    },
    {
      "Sid": "VisualEditor1",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::company1-sales/*"
    }
  ]
}

4. Edit the Policy

Click Edit policy on the Permissions tab to open the policy editor. You can switch between the Visual editor and the JSON tab.

4.1 Rename Statement IDs

Replace autogenerated Sid values with clear identifiers:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAllEC2Actions",
      "Effect": "Allow",
      "Action": "ec2:*",
      "Resource": "*"
    },
    {
      "Sid": "AllowS3GetObject",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::company1-sales/*"
    }
  ]
}

4.2 Deny Stopping EC2 Instances

Add a statement to prevent developers from stopping instances:

{
  "Sid": "DenyStopInstances",
  "Effect": "Deny",
  "Action": "ec2:StopInstances",
  "Resource": "*"
}

4.3 Final Policy JSON

Combine all statements into your final policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAllEC2Actions",
      "Effect": "Allow",
      "Action": "ec2:*",
      "Resource": "*"
    },
    {
      "Sid": "AllowS3GetObject",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::company1-sales/*"
    },
    {
      "Sid": "DenyStopInstances",
      "Effect": "Deny",
      "Action": "ec2:StopInstances",
      "Resource": "*"
    }
  ]
}

Click Save changes to apply the updated policy.

References

• AWS IAM User Guide – Policies and Permissions
• IAM JSON Policy Elements: Statement