🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

📝 धडा 03 — Policies: लिखित नियम

📍 तुम्ही इथे आहात: 12 पैकी धडा 03 · मागे: lesson-02-users-groups-root · पुढे: lesson-04-how-aws-decides

📦 या ब्रँचमध्ये काय आहे

धडे 01–02, आणि त्यासोबत policy document वाचणे आणि लिहिणे: Effect, Action, Resource, Condition, wildcards, आणि एकाच policy ने प्रत्येक शिक्षकाला खाजगी folder देणारा policy variable ${aws:username}. पाहा iam/policies/own-homework-folder.json.

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

ओळखपत्र कार्यालयातला नियम म्हणजे चार ओळींचे एक छोटे कार्ड:

Effect — हो की नाही (Allow / Deny)
Action — तुम्ही काय करू शकता ("घेणे", "आत ठेवणे")
Resource — कोणत्या वस्तूवर ("homework चे कपाट")
Condition — फक्त तेव्हाच… ("फक्त दुसऱ्या तपासणीसह", धडा 07)

यातली हुशार युक्ती म्हणजे आपोआप भरणारी एक रिकामी जागा: "तुम्ही तुमच्या स्वतःच्या नावाचे homework चे कपाट वापरू शकता". एकच कार्ड प्रत्येक शिक्षिकेसाठी चालते — ऐश्वर्याच्या प्रतीत "aishwarya" असते, कतरिनाच्या प्रतीत "katrina" — आणि कोणीही दुसऱ्याचे कपाट वापरू शकत नाही.

🗺️ आकृती

flowchart LR
    st["📝 Statement OwnFolderOnly<br/>Effect: Allow<br/>Action: s3:GetObject, s3:PutObject<br/>Resource: school-homework/USERNAME/*"]
    a["🪪 aishwarya → school-homework/aishwarya/essay.txt"]
    b["🪪 aishwarya → school-homework/katrina/essay.txt"]
    st -->|"1 variable = aishwarya · match"| a --> ok["✅ ALLOW"]
    st -->|"2 no match"| b --> no["🚫 IMPLICIT DENY"]

🗺️ काढलेली आकृती + एक lab: https://school-edh.pages.dev/iam/lesson-diagrams.html#l03

❓ काय

रचना — {"Version": "2012-10-17", "Statement": [ … ]}. नेहमी version 2012-10-17 वापरा; जुने version policy variables ना support करत नाही.
Statement fields — Sid (एक लेबल), Effect, Action किंवा NotAction, Resource किंवा NotResource, ऐच्छिक Condition. Resource policies (धडा 09) आणि trust policies (धडा 05) मध्ये Principal ही जोडलेले असते.
Wildcards — * म्हणजे कितीही अक्षरे, ? म्हणजे एक अक्षर: s3:Get*, arn:aws:s3:::school-reports/*. Action ची नावे case-insensitive असतात; resource ARNs case-sensitive असतात.
Policy variables — ${aws:username}, ${aws:PrincipalTag/team}, … हे evaluation च्या वेळी request मधून भरले जातात.
Identity policy चे प्रकार — AWS managed (AWS ने लिहिलेल्या, उदा. ReadOnlyAccess), customer managed (तुमच्या, पुन्हा वापरता येणाऱ्या, versions असलेल्या) आणि inline (एकाच user/group/role मध्ये बसवलेल्या). Customer managed ला प्राधान्य द्या.
S3 मधला बारकावा — bucket actions (s3:ListBucket) ना bucket ARN arn:aws:s3:::school-reports लागतो; object actions ना arn:aws:s3:::school-reports/* लागतो. म्हणूनच read-reports.json मध्ये दोन्ही आहेत.

🤔 का

कारण policy म्हणजे तुमच्या data ला कोण हात लावू शकतो हे ठरवणारा code आहे, आणि शब्दरचनेतले छोटे बदल (* चुकीच्या जागी, /* शिवायचा bucket ARN) उत्तर बदलतात. एक statement नेमकेपणाने वाचणे हेच IAM चे मूळ कौशल्य आहे.

🔧 कसे (या repo मध्ये)

iam/demo.py मधला policies() own-homework-folder.json मधले एक statement print करतो आणि दोन writes मागतो: aishwarya ने तिच्या स्वतःच्या folder मध्ये, आणि aishwarya ने katrina च्या folder मध्ये. iam/evaluate.py मधला _subst() ${aws:username} भरतो; _glob() हा * आणि ? हाताळतो.

🧪 करून पाहा

python3 iam/demo.py policies
python3 - <<'EOF'
import sys; sys.path.insert(0, "iam"); from evaluate import decide, load
doc = {"Version": "2012-10-17", "Statement": [{"Sid": "ReadAnything", "Effect": "Allow", "Action": "s3:Get*", "Resource": "arn:aws:s3:::school-reports/*"}]}
katrina = "arn:aws:iam::111122223333:user/katrina"
for action in ("s3:GetObject", "S3:getobjecttagging", "s3:PutObject"):
    print(action.ljust(20), decide(katrina, action, "arn:aws:s3:::school-reports/term1.pdf", identity=[("mine", doc)])[0])
print("katrina's own folder", decide(katrina, "s3:PutObject", "arn:aws:s3:::school-homework/katrina/essay.txt", identity=[("own", load("own-homework-folder"))])[0])
EOF

खऱ्या account वर (AWS CLI आणि credentials लागतात) — policy वापरण्याआधी तिचे lint करा, मग ती customer managed policy म्हणून साठवा:

aws accessanalyzer validate-policy --policy-type IDENTITY_POLICY --policy-document file://iam/policies/own-homework-folder.json
aws iam create-policy --policy-name own-homework-folder --policy-document file://iam/policies/own-homework-folder.json

✅ तपासा — तुम्हाला काय दिसायला हवे

policies statement JSON म्हणून print करतो, मग aishwarya च्या folder साठी ✅ … ALLOW — identity policy own-homework-folder#OwnFolderOnly allows it आणि katrina च्या folder साठी 🚫 … IMPLICIT DENY. तुमचा snippet s3:GetObject साठी ALLOW, S3:getobjecttagging साठी ALLOW (actions case पाहत नाहीत; s3:Get* त्याला लागू होते), s3:PutObject साठी IMPLICIT DENY, आणि katrina च्या स्वतःच्या folder साठी ALLOW print करतो.

🏁 तुम्ही आत्ताच काय सिद्ध केले

Statement म्हणजे चार नेमकी fields; wildcards आणि variables मुळे एकच छोटी policy अनेक लोकांना चालते, आणि तरीही त्यांपैकी कोणीही स्वतःच्या resources पलीकडे पोहोचू शकत नाही.

⚠️ नेहमीच्या चुका

"ते लवकर झाले" म्हणून "Action": "*", "Resource": "*"
s3:ListBucket साठी bucket ARN विसरणे (किंवा object actions साठी /* विसरणे)
s3:Get* चा अर्थ तुम्हाला वाटतो त्यापेक्षा जास्त असणे — तो s3:GetBucketPolicy, s3:GetObjectAcl, … यांनाही जुळतो
जुने "Version": "2008-10-17" (किंवा version नसणेच) — मग ${aws:username} हा साधा मजकूर ठरतो

🏭 प्रत्यक्ष वापरात हे का महत्त्वाचे: teams policies git मध्ये files म्हणून ठेवतात, CI मध्ये validate-policy ने त्यांचे lint करतात, आणि code सारखेच त्यांचे review करतात. Policy मधला बदल म्हणजे ती जोडलेल्या प्रत्येकाच्या परवानगीतला बदल.

⏭️ पुढे

एक नियम हो आणि दुसरा नाही म्हणाला तर? AWS कसा निर्णय घेतो — कार्यालय कार्डे कोणत्या क्रमाने वाचते.

git checkout lesson-04-how-aws-decides

📝 Lesson 03 — Policies: the written rules

📍 You are here: Lesson 03 of 12 · Previous: lesson-02-users-groups-root · Next: lesson-04-how-aws-decides

📦 What's in this branch

Lessons 01–02, plus reading and writing a policy document: Effect, Action, Resource, Condition, wildcards, and the policy variable ${aws:username} that gives every teacher a private folder with one policy. See iam/policies/own-homework-folder.json.

🧒 Explain like I'm 5

A rule in the ID office is a small card with four lines:

Effect — yes or no (Allow / Deny)
Action — what you may do ("borrow", "put in")
Resource — on which thing ("the homework shelf")
Condition — only when… ("only with a second check", lesson 07)

The clever trick is a blank that fills itself in: "you may use the homework shelf with your own name on it". One card works for every teacher — Aishwarya's copy reads "aishwarya", Katrina's reads "katrina" — and nobody can use somebody else's shelf.

🗺️ Diagram

flowchart LR
    st["📝 Statement OwnFolderOnly<br/>Effect: Allow<br/>Action: s3:GetObject, s3:PutObject<br/>Resource: school-homework/USERNAME/*"]
    a["🪪 aishwarya → school-homework/aishwarya/essay.txt"]
    b["🪪 aishwarya → school-homework/katrina/essay.txt"]
    st -->|"1 variable = aishwarya · match"| a --> ok["✅ ALLOW"]
    st -->|"2 no match"| b --> no["🚫 IMPLICIT DENY"]

🗺️ Drawn version + a lab: https://school-edh.pages.dev/iam/lesson-diagrams.html#l03

❓ What

Structure — {"Version": "2012-10-17", "Statement": [ … ]}. Always use version 2012-10-17; the older version does not support policy variables.
Statement fields — Sid (a label), Effect, Action or NotAction, Resource or NotResource, optional Condition. Resource policies (lesson 09) and trust policies (lesson 05) add Principal.
Wildcards — * any run of characters, ? one character: s3:Get*, arn:aws:s3:::school-reports/*. Action names are case-insensitive; resource ARNs are case-sensitive.
Policy variables — ${aws:username}, ${aws:PrincipalTag/team}, … are filled in from the request at evaluation time.
Kinds of identity policy — AWS managed (written by AWS, e.g. ReadOnlyAccess), customer managed (yours, reusable, versioned) and inline (embedded in one user/group/role). Prefer customer managed.
S3 detail — bucket actions (s3:ListBucket) need the bucket ARN arn:aws:s3:::school-reports; object actions need arn:aws:s3:::school-reports/*. That is why read-reports.json lists both.

🤔 Why

Because a policy is code that decides who can touch your data, and small wording changes (* in the wrong place, the bucket ARN without /*) change the answer. Reading one statement precisely is the core IAM skill.

🔧 How (in this repo)

policies() in iam/demo.py prints the one statement in own-homework-folder.json and asks for two writes: aishwarya to her own folder and aishwarya to katrina's. _subst() in iam/evaluate.py fills in ${aws:username}; _glob() handles * and ?.

🧪 Try it

python3 iam/demo.py policies
python3 - <<'EOF'
import sys; sys.path.insert(0, "iam"); from evaluate import decide, load
doc = {"Version": "2012-10-17", "Statement": [{"Sid": "ReadAnything", "Effect": "Allow", "Action": "s3:Get*", "Resource": "arn:aws:s3:::school-reports/*"}]}
katrina = "arn:aws:iam::111122223333:user/katrina"
for action in ("s3:GetObject", "S3:getobjecttagging", "s3:PutObject"):
    print(action.ljust(20), decide(katrina, action, "arn:aws:s3:::school-reports/term1.pdf", identity=[("mine", doc)])[0])
print("katrina's own folder", decide(katrina, "s3:PutObject", "arn:aws:s3:::school-homework/katrina/essay.txt", identity=[("own", load("own-homework-folder"))])[0])
EOF

On a real account (needs the AWS CLI and credentials) — lint a policy before you use it, then store it as a customer managed policy:

aws accessanalyzer validate-policy --policy-type IDENTITY_POLICY --policy-document file://iam/policies/own-homework-folder.json
aws iam create-policy --policy-name own-homework-folder --policy-document file://iam/policies/own-homework-folder.json

✅ Verify — what you should see

policies prints the statement as JSON, then ✅ … ALLOW — identity policy own-homework-folder#OwnFolderOnly allows it for aishwarya's folder and 🚫 … IMPLICIT DENY for katrina's. Your snippet prints ALLOW for s3:GetObject, ALLOW for S3:getobjecttagging (actions ignore case; s3:Get* covers it), IMPLICIT DENY for s3:PutObject, and ALLOW for katrina's own folder.

🏁 What you just proved

A statement is four precise fields; wildcards and variables let one small policy serve many people without letting any of them reach past their own resources.

⚠️ Common mistakes

"Action": "*", "Resource": "*" because "it was quicker"
forgetting the bucket ARN for s3:ListBucket (or the /* for object actions)
s3:Get* meaning more than you think — it also matches s3:GetBucketPolicy, s3:GetObjectAcl, …
the old "Version": "2008-10-17" (or none) — then ${aws:username} is plain text

🏭 Why this matters in production: teams keep policies as files in git, lint them with validate-policy in CI, and review them like code. A policy change is a permission change for everyone attached to it.

⏭️ Next

What if one rule says yes and another says no? How AWS decides — the order the office reads the cards.

git checkout lesson-04-how-aws-decides

← Previoususers groups root Next →how aws decides

This page is the lesson's README from the lesson-03-policies branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.