---
title: "Anatomy of IAM Policies in AWS Cheat Sheet | Cybr"
url: https://cybr.com/cheat-sheets/iam-policy-anatomy/
---

# Anatomy of IAM Policies in AWS

![AWS IAM](https://cybr.com/aws-security-services/icons/Arch_AWS-Identity-and-Access-Management_64.svg)

![Christophe Limpalair](https://cybr.com/cloud-attack-simulations/christophe.png) [**Cybr**](https://cybr.com/)

[https://cybr.com ↗](https://cybr.com/) [Christophe Limpalair ↗](https://www.linkedin.com/in/christophelimpalair/) [@christophelimp ↗](https://twitter.com/christophelimp)

## Example IAM Policy

**IAM policy elements and their meaning**

## Example: Cross-Account Access

**Cross-account access with RoleB**

### Account A · 222222222222

Assume Role Policy — attach to **RoleA and AdminA** in the **source account**.

**Assume Role Policy**

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::111111111111:role/RoleB"
    }
  ]
}
```

- **Account B** is our “**destination**”.
- **Account A** is our “**source**”.
- We want users or resources in **Account A** to be able to **assume a role in Account B**.
- Once a user or resource assumes the role in Account B, requests made with the **temporary role credentials** use the role session’s permissions, **not the original identity’s permissions**. Other applicable policies can further restrict access.
- For example, admin privileges in Account A **do not carry over** into a limited RoleB session in Account B. To act with their original permissions again, the caller uses their original credentials or switches back in the console; assuming RoleB **does not revoke those permissions**.
- While using **RoleB**, RoleA and user AdminA will be able to view the desired logs in **Account B**, provided **no other applicable policy blocks access**.
- This all works thanks to **temporary security credentials** issued via the **AWS Security Token Service (STS)**.

### Account B · 111111111111

Trust Relationship Policy — defines **who can assume RoleB** in the destination account.

**Trust Relationship Policy**

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::222222222222:role/RoleA",
          "arn:aws:iam::222222222222:user/AdminA"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```

Permissions Policy — defines **what RoleB can do**. These example log groups are in `us-east-1`.

**Permissions Policy**

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:GetLogEvents",
        "logs:FilterLogEvents",
        "logs:DescribeLogStreams"
      ],
      "Resource": [
        "arn:aws:logs:us-east-1:111111111111:log-group:log-group-name-1:*",
        "arn:aws:logs:us-east-1:111111111111:log-group:log-group-name-2:*"
      ]
    }
  ]
}
```

## Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Goal

Preview prompt

Prompt

[](https://cybr.com/)

Sources and more info:[IAM policy elements ↗](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html)[Condition operators ↗](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html)[STS AssumeRole ↗](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html)[CloudWatch Logs permissions ↗](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-access-control-overview-cwl.html)

[More AWS security cheat sheets](https://cybr.com/cheat-sheets/)