Serverless Developer Guide
Advanced topics
You can do a lot just using AWS managed policies. As you progress on your journey, you should 
explore the following more advanced topics.
Resource-based policies
When you create a permissions policy to restrict access to a resource, you can choose an identity-
based policy or a resource-based policy.
Identity-based policies are attached to a user, group, or role. These policies let you specify what 
that identity can do (its permissions). For example, you can attach the policy to the group named 
RemoteDataMinders, stating that group members are allowed to get items from an Amazon 
DynamoDB table named MyCompany.
Resource-based policies are attached to a resource. For example, you can attach resource-based 
policies to Amazon S3 buckets, Amazon Simple Queue Service queues, VPC endpoints, and AWS 
Key Management Service encryption keys.
With resource-based policies, you can specify who has access to the resource and what actions they 
can perform on it.
Related resource(s):
• Identity-based and resource-based policies in the oﬃcial documentation
• AWS Services that work with IAM is a comprehensive list of services, including which ones 
support resource-based policies
IAM permissions boundaries
With a permissions boundary, you set the maximum permissions that an identity-based policy can 
grant to an IAM entity.
When you set a permissions boundary for an entity, the entity can perform only the actions 
that are allowed by both its identity-based policies and its permissions boundaries. Permissions 
boundaries limit the maximum permissions for the user or role.
For example, assume that the role named CoreServiceAdmin should be allowed to manage only 
Amazon S3, Amazon CloudWatch, and AWS Lambda. To enforce this rule, you can set a policy to set 
the permissions boundary for the CoreServiceAdmin role.
Advanced topics 45