World map

 

BM

World A2: Keys & Guards

Policies in JSON

You will learn: to read a policy line by line, and to change one line safely.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

Aina’s key card says: “Allow: read the files on the menu shelf.” She tries to change today’s menu. What happens?

Watch

That key card is a policy: A key card written in JSON: Effect (Allow or Deny), Action (what) and Resource (on which thing)., written in JSON. Tap the line that says what Aina may do.

Tap the line with the action.

0 of 1 found

Watch

Each statement answers three questions. Allow or Deny? Which action? On which thing? Sort these values.

Drag a card into a box. Or tap the card, then tap the box.

        Try it

        Aina must also save today’s menu. Change the pink line so AWS says Allow. Don’t open every S3 action.

        Change the pink line so AWS says Allow.

        The request

        Who
        Aina (IAM user)arn:aws:iam::111122223333:user/aina
        Wants to
        s3:PutObject
        On
        arn:aws:s3:::kedai-menu/today.json
        Identity policy (key ring) · menu-reader
        {
        "Version": "2012-10-17",
        "Statement": [
        {
        "Effect": "Allow",
        "Resource": "arn:aws:s3:::kedai-menu/*"
        }
        ]
        }

        Check

        A star is a wildcard. Which actions does s3:Get* allow?

        Predict

        Now Aina opens a file in a different bucket, kedai-orders. Her policy only names kedai-menu. Predict.

        Read the request and its policies. Will AWS say Allow or Deny?

        The request

        Who
        Aina (IAM user)arn:aws:iam::111122223333:user/aina
        Wants to
        s3:GetObject
        On
        arn:aws:s3:::kedai-orders/today.json
        Identity policy (key ring) · menu-reader
        {
        "Version": "2012-10-17",
        "Statement": [
        {
        "Effect": "Allow",
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::kedai-menu/*"
        }
        ]
        }
        Your guess:

        You did it!

        You can now read a policy’s Effect, Action and Resource, and change one line.

        Go deeper (optional)

        "Version": "2012-10-17" is the policy language’s version, not today’s date. Always use it.

        Action names ignore upper and lower case. Resource ARNs do not: kedai-menu/Today.json and kedai-menu/today.json are two different files.