Serverless Developer Guide
{ 
    "Version": "2012-10-17", 
    "Statement": [ 
        { 
            "Effect": "Allow", 
            "Action": [  
                "ec2:DescribeInstances",  
                "ec2:RunInstances" 
                ... 
                <additional actions> 
            ], 
            "Resource": "*", 
            "Condition": { 
                "IpAddress": { "aws:SourceIp": "12.34.56.78/32"} 
            } 
        } 
    ]
}
First, notice there is no Principal element in the policy. This is because attaching a policy to a 
principal implicitly speciﬁes the principal to which the policy applies. Policies can exist apart from 
principals, so that common policies can be re-used for many roles, services, etc.
The Effect is Allow, so this is a policy that explicitly grants access. This is the most common type 
of policy. You can write policies that explicitly Deny access as well.
The Action is an array of multiple actions that permit using EC2 to run instances and describe 
instance metadata. Actions can be a single action, or multiple actions in an array like depicted here.
There is no speciﬁc ARN in the Resource ﬁeld, but instead *, which is a wildcard character that 
means this policy applies to all resources.
Finally, we have a Condition set that applies this policy only if the caller's IP address matches 
exactly 12.34.56.78. Conditions are optional, and do not need to be speciﬁed if the policy is to be 
applied unconditionally.
IAM policies can be combined, each with varying degrees of sensitivity and speciﬁcity. The net 
eﬀect of combining policies is ﬁne-grained access control for every resource in an AWS account.
Fundamentals 43