📘 AWS IAM Explained Desi-Style — With Hall Passes, Boundaries & Principal’s Final Word! (Part 2)

🎒 Welcome back to the IAM School Series!

In Part 1, we decoded IAM with fun school analogies:

• 👨‍🏫 IAM = Principal

• 👩‍🎓 Users = Students

• 🎫 Policies = Hall Passes

• 🧪 AWS Services = Classrooms

This time, we dive into the hidden layers of IAM — Permission Boundaries, Inline Policies, and the all-powerful Explicit Deny — the final word from your school's Principal! 🏫

---

🚪 Part 2: “Hall Pass Hai, Par Boundary Ke Bahar Nahi Ja Sakta!”

Ever had this moment?

“Policy mein allow hai, phir bhi access denied aa raha hai?”

Welcome to the world of:

• ✅ Managed vs Inline Policies

• 🚧 Permission Boundaries

• ⛔ Explicit Deny overrides all

Let’s understand it Desi-Style! 🇮🇳

---

🧱 IAM Policy Types — The School Way

---

🏫 School Example 1: The Curious Student and The Lab Room

👨‍🎓 Utkarsh, a science student, receives:

• 📝 An Inline Policy from the Chemistry Teacher:
  "Utkarsh can access the Chemistry Lab anytime."

• 🚧 But the Principal’s Boundary Rule says:
  "No one is allowed in labs after 5 PM."

🕔 Utkarsh tries to enter the lab at 5:30 PM.

🚫 Access Denied!
Even with permission, the boundary overrides it.

---

💻 Real AWS Example 1: EC2 Access Blocked by Boundary

IAM User: dev-user

✅ User Policy:

{
  "Effect": "Allow",
  "Action": "ec2:StartInstances",
  "Resource": "*"
}

❌ Permission Boundary:

{
  "Effect": "Allow",
  "Action": "s3:*",
  "Resource": "*"
}

🔐 Result:
Even though the user has EC2 access in their policy, the boundary allows only S3 actions.

🧱 Boundary is the boss! 🔒

---

🏫 School Example 2: Guest Lecturer Blocked by Rules

👨‍🏫 Mr. Sharma (a guest lecturer) has:

• 🏛️ A visitor pass signed by the Principal (Trust Policy)

• 🧾 Permission from the subject teacher to teach in Room 7B (Permissions Policy)

But the Rulebook says:

"No guest lecturers allowed during exam week."

❌ Result: Access Denied
⛔ Explicit Deny wins — always!

---

💻 Real AWS Example 2: Lambda + Trust + Deny

🛂 Trust Policy (Allows Role Assumption):

{
  "Effect": "Allow",
  "Principal": {
    "Service": "lambda.amazonaws.com"
  },
  "Action": "sts:AssumeRole"
}

✅ Permissions Policy:

{
  "Effect": "Allow",
  "Action": "dynamodb:PutItem",
  "Resource": "arn:aws:dynamodb:<Region>:<AccountID>:table/StudentData"
}

❌ Explicit Deny:

{
  "Effect": "Deny",
  "Action": "dynamodb:*",
  "Resource": "*"
}

🔐 Result:

Access denied — even though permissions exist — because explicit deny overrides all.

---

🧾 Inline vs Managed — Who Gets What?

---

🏫 School Example 3: Project Day Chaos

🧑‍🎓 Aman wants to access the Computer Lab.

• ✅ Has Managed Policy: "Can access all labs"

• ✅ Has Inline Policy: "Access only to Computer Lab"

• ❌ Principal sets Boundary: "Only Bio students allowed in labs today"

🔐 Result: ❌ Access Denied

Boundary wins over all other permissions.

---

💻 Real AWS Example 3: S3 Uploads Within Boundaries

IAM User: awslearner

📝 Inline Policy:

{
  "Effect": "Allow",
  "Action": "s3:PutObject",
  "Resource": "arn:aws:s3:::project-submissions/*"
}

🚧 Permission Boundary:

{
  "Effect": "Allow",
  "Action": "s3:PutObject",
  "Resource": "arn:aws:s3:::project-submissions/*"
}

✅ Access works

Because the action is allowed in both the user policy and the permission boundary.

❗ But if the user tried s3:DeleteObject, it would be denied, as it's not included in the boundary.

---

🧠 IAM Evaluation Flow — Principal Ki Marzi

• ✅ Check user’s policies — is action allowed?

• ✅ Is it within permission boundary?

• ❌ Any explicit deny?

• ✅ Final result = All above must match ✅

📌 IAM is AND logic — all doors must open.

---

🎓 Summary — IAM Isn’t Just Hall Passes

---

✅ Key Takeaways from Part 2

• ✅ Permissions aren’t enough — boundaries and denies matter too

• 📝 Inline = user-specific; Managed = reusable

• 🔐 Always check boundaries during IAM debugging

• ⛔ Explicit Deny is the final word — like a strict principal!

---

🔜 What’s Next?

🎯 Part 3 Coming Soon:
"IAM Roles & STS — Guest Lecturers & Temporary Access Explained"

We’ll explore:

• sts:AssumeRole

• Temporary credentials

• Cross-account access (like inter-school guest lectures)

IAM ka syllabus abhi pura nahi hua! 🧑‍🏫
Stay tuned — and remember: “Hall pass ke bina entry allowed nahi hai!” 🎫

---

👨‍💻 About Me

Hi! I'm Utkarsh, a Cloud Specialist & AWS Community Builder who loves turning complex AWS topics into fun chai-time stories ☕
👉 Explore more

---

🗣️ Your Feedback = My Fuel

If this made IAM:

• Easy to understand 💡

• Fun to learn 🎉

• Or gave you a school flashback 🎒

Then share it, comment, or just say hi — it helps me keep the chai warm and the blogs coming! ☁️💻

---

Jai Cloud! Jai Code! Jai IAM! 🇮🇳🚀