title: What is the difference between Canned Policy and Custom Policy?
body: <p>I am looking for an answer at a conceptual level. So please refrain from simply providing a link to Aws documentation as an answer.</p>
  <p>It is how a <strong>canned policy</strong> is generated by <a href="https://github.com/boto/boto" rel="nofollow noreferrer">boto</a></p>
  <pre class="lang-python prettyprint-override"><code>@staticmethod
  def _canned_policy(resource, expires):
      &quot;&quot;&quot;
      Creates a canned policy string.
      &quot;&quot;&quot;
      policy = ('{&quot;Statement&quot;:[{&quot;Resource&quot;:&quot;%(resource)s&quot;,'
                '&quot;Condition&quot;:{&quot;DateLessThan&quot;:{&quot;AWS:EpochTime&quot;:'
                '%(expires)s}}}]}' % locals())
      return policy
  </code></pre>
  <p>And it is how <strong>custom policy</strong> is generated by the same library</p>
  <pre class="lang-python prettyprint-override"><code>@staticmethod
  def _custom_policy(resource, expires=None, valid_after=None, ip_address=None):
      &quot;&quot;&quot;
      Creates a custom policy string based on the supplied parameters.
      &quot;&quot;&quot;
      condition = {}
      # SEE: http://docs.amazonwebservices.com/AmazonCloudFront/latest/DeveloperGuide/RestrictingAccessPrivateContent.html#CustomPolicy
      # The 'DateLessThan' property is required.
      if not expires:
          # Defaults to ONE day
          expires = int(time.time()) + 86400
      condition[&quot;DateLessThan&quot;] = {&quot;AWS:EpochTime&quot;: expires}
      if valid_after:
          condition[&quot;DateGreaterThan&quot;] = {&quot;AWS:EpochTime&quot;: valid_after}
      if ip_address:
          if '/' not in ip_address:
              ip_address += &quot;/32&quot;
          condition[&quot;IpAddress&quot;] = {&quot;AWS:SourceIp&quot;: ip_address}
      policy = {&quot;Statement&quot;: [{
                   &quot;Resource&quot;: resource,
                   &quot;Condition&quot;: condition}]}
      return json.dumps(policy, separators=(&quot;,&quot;, &quot;:&quot;))
  </code></pre>
  <p>To my mind, a canned policy is essentially a custom policy but with fewer attributes.</p>
  <p>If it is a correct observation, then why the need for two different policies?</p>