IAM Policy

What a IAM User or IAM Group is authorised to do.

Applying policies to an IAM Group is preferred over an IAM User

A policy comprises an

• effect allow or deny
• action the allowed API calls e.g. `ec2:*
• resources the resources where these policies apply
• condition further restrictions

You can define customer policies or use AWS managed policies which are predefined.