IAM policies in depth: conditions, variables and boundaries

Start every lab from now on like this:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$acct = aws sts get-caller-identity --query Account --output text

All policy files use single-quoted here-strings (@' … '@). In a double-quoted one, PowerShell would treat ${aws:username} as its own variable and quietly remove it.

1A Region guard: deny everything outside Mumbai

Paste this whole block:

@'
{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": "ec2:*", "Resource": "*" }] }
'@ | Set-Content allow-ec2.json

@'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "OnlyMumbai",
    "Effect": "Deny",
    "NotAction": ["iam:*", "sts:*", "organizations:*", "budgets:*", "ce:*", "support:*",
                  "cloudfront:*", "route53:*", "health:*", "account:*", "signin:*"],
    "Resource": "*",
    "Condition": { "StringNotEquals": { "aws:RequestedRegion": ["ap-south-1"] } }
  }]
}
'@ | Set-Content region-guard.json

NotAction lists global services that don’t run in a Region, so the guard doesn’t break sign-in, IAM or billing.

2Validate and simulate the guard

Run this:

aws accessanalyzer validate-policy --policy-type IDENTITY_POLICY --policy-document file://region-guard.json --query "findings[].[findingType,issueCode]" --output text

foreach ($r in 'ap-south-1','us-east-1') {
  aws iam simulate-custom-policy --policy-input-list file://allow-ec2.json file://region-guard.json --action-names ec2:RunInstances --context-entries "ContextKeyName=aws:RequestedRegion,ContextKeyValues=$r,ContextKeyType=string" --query "EvaluationResults[].EvalDecision" --output text
}

You should see this (Access Analyzer may print a SUGGESTION line or nothing):

allowed
explicitDeny

3Your own corner with a policy variable

Paste this whole block:

@'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["ssm:PutParameter", "ssm:GetParameter"],
    "Resource": "arn:aws:ssm:ap-south-1:ACCOUNT_ID:parameter/lab/${aws:username}/*"
  }]
}
'@ -replace 'ACCOUNT_ID', $acct | Set-Content my-params.json

$myParam = "arn:aws:ssm:ap-south-1:$($acct):parameter/lab/yourname.admin/note"
$other = "arn:aws:ssm:ap-south-1:$($acct):parameter/lab/priya.dev/note"
foreach ($res in $myParam, $other) {
  aws iam simulate-custom-policy --policy-input-list file://my-params.json --action-names ssm:PutParameter --resource-arns $res --context-entries "ContextKeyName=aws:username,ContextKeyValues=yourname.admin,ContextKeyType=string" --query "EvaluationResults[].EvalDecision" --output text
}

You should see this:

allowed
implicitDeny

One policy, attached to a whole group, and each person can only write under their own name.

4Tag-based access: only your own servers

Paste this whole block:

@'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["ec2:StartInstances", "ec2:StopInstances"],
    "Resource": "arn:aws:ec2:ap-south-1:*:instance/*",
    "Condition": { "StringEquals": { "ec2:ResourceTag/owner": "${aws:username}" } }
  }]
}
'@ | Set-Content owner-tag.json

$inst = "arn:aws:ec2:ap-south-1:$($acct):instance/i-0123456789abcdef0"
foreach ($owner in 'yourname.admin','priya.dev') {
  aws iam simulate-custom-policy --policy-input-list file://owner-tag.json --action-names ec2:StopInstances --resource-arns $inst --context-entries "ContextKeyName=aws:username,ContextKeyValues=yourname.admin,ContextKeyType=string" "ContextKeyName=ec2:ResourceTag/owner,ContextKeyValues=$owner,ContextKeyType=string" --query "EvaluationResults[].EvalDecision" --output text
}

You should see this:

allowed
implicitDeny

5A permission boundary: admin, but only up to a ceiling

Paste this whole block:

@'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["ssm:*", "ec2:Describe*", "s3:Get*", "s3:List*"],
    "Resource": "*"
  }]
}
'@ | Set-Content boundary.json

$bArn = aws iam create-policy --policy-name lab-boundary --policy-document file://boundary.json --query Policy.Arn --output text
$devArn = aws iam create-user --user-name lab-dev --permissions-boundary $bArn --tags Key=course,Value=saatvedha-aws Key=lesson,Value=07 --query User.Arn --output text
aws iam attach-user-policy --user-name lab-dev --policy-arn arn:aws:iam::aws:policy/AdministratorAccess
aws iam simulate-principal-policy --policy-source-arn $devArn --action-names ec2:TerminateInstances ssm:GetParameter --query "EvaluationResults[].[EvalActionName,EvalDecision]" --output text

You should see this:

ec2:TerminateInstances  implicitDeny
ssm:GetParameter        allowed

lab-dev has AdministratorAccess, yet can’t terminate an instance, because the boundary doesn’t allow it. The boundary itself grants nothing: remove AdministratorAccess and ssm:GetParameter would be denied too.

✅ Checkpoint: The guard gives allowed for Mumbai and explicitDeny for us-east-1, the variable and tag rules only allow your own items, and the boundary blocks terminate. Keep the files for the break lab.