Reading policies line by line

Let us read a realistic identity policy for a reporting job and understand every line.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListReportPrefix",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::acme-data",
      "Condition": {
        "StringLike": {"s3:prefix": ["reports/*"]}
      }
    },
    {
      "Sid": "ReadReports",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::acme-data/reports/*"
    },
    {
      "Sid": "DecryptWithDataKey",
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "arn:aws:kms:eu-central-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
      "Condition": {
        "StringEquals": {"kms:ViaService": "s3.eu-central-1.amazonaws.com"}
      }
    }
  ]
}

Version must be 2012-10-17. It is the policy language version, not a date you update.

Sid is an optional label. Use it; it makes reviews and error messages easier to follow.

ListReportPrefix: ListBucket applies to the bucket ARN, not to objects. The condition restricts listing to keys under reports/. Without it, the job could list every key in the bucket, which may itself reveal sensitive information.

ReadReports: GetObject applies to object ARNs, so the resource ends with /reports/*. This is the most common S3 policy mistake: putting object actions on the bucket ARN or the reverse.

DecryptWithDataKey: if objects are encrypted with a customer managed KMS key, reading them also requires kms:Decrypt on that key. The kms:ViaService condition means the key can only be used through S3 in that Region, not called directly.

Wildcards

* in actions or resources is not always wrong, but it should be deliberate. s3:Get* includes more actions than you may expect, such as reading bucket policies and ACLs. Prefer listing actions explicitly for anything sensitive.

NotAction and NotResource

These invert matching and are easy to misread. "Effect": "Allow", "NotAction": "iam:*" allows every action in every service except IAM, which is very broad. Use them mainly in Deny statements, where their meaning is safer.

Testing

The IAM policy simulator in the console, or aws iam simulate-principal-policy from the CLI, evaluates a policy against specific actions and resources without making real calls. Use it before attaching anything.