text: Serverless 
  
  **Advanced topics**
  
  You can do a lot just using AWS managed policies. As you progress on your journey, you should 
  
  explore the following more advanced topics. 
  
  **Resource-based policies**
  
  When you create a permissions policy to restrict access to a resource, you can choose an*identity-*
  *based policy*or a*resource-based policy*. 
  
  **Identity-based policies**are attached to a user, group, or role. These policies let you specify what 
  that identity can do (its permissions). For example, you can attach the policy to the group named 
  
  RemoteDataMinders, stating that group members are allowed to get items from an Amazon 
  
  DynamoDB table named MyCompany. 
  
  **Resource-based policies**are attached to a resource. For example, you can attach resource-based 
  policies to Amazon S3 buckets, Amazon Simple Queue Service queues, VPC endpoints, and AWS 
  
  Key Management Service encryption keys. 
  
  With resource-based policies, you can specify who has access to the resource and what actions they 
  
  can perform on it. 
  
  **Related resource(s):**
  
  • Identity-based and resource-based policies in the oﬃcial documentation 
  
  • AWS Services that work with IAM is a comprehensive list of services, including which ones 
  
  support resource-based policies 