title: AWS IAM applicable policies and attached entities
body: <p>After asking <a href="https://stackoverflow.com/questions/45674218/aws-sqs-limit-to-ec2-with-iam-role">this</a> question I did some digging and found a couple of policies with:</p>
  <pre><code>{
    &quot;Effect&quot;:&quot;Allow&quot;,
    &quot;Action&quot;:&quot;*&quot;,
    &quot;Resource&quot;:&quot;*&quot;
  }
  </code></pre>
  <p>in them.</p>
  <p>Reading through the <a href="http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html" rel="nofollow noreferrer">policies evaluation logic</a> page again the second step stands out to me:</p>
  <ol start="2">
  <li>Evaluate all applicable policies.</li>
  </ol>
  <p>The first part of my question is: <em>How does AWS determine what policies are applicable?</em>
  To my understanding this is done by looking at the <em>Principle</em> and/or <em>Resource</em> keys.</p>
  <p>BUT: in IAM these policies have attached entities which are to my understanding the same as Principles. Which gets to the second part of the question:
  <em>What does an attached entity do to a policy?</em>
  As far as i understand all this does is tell AWS that the policy is applicable to a role, but I do not understand how this works with a <code>&quot;Resource&quot;:&quot;*&quot;</code> in the policy.</p>
  <h3>so:</h3>
  <ol>
  <li>How does AWS determine what policies are applicable?</li>
  <li>What does an attached entity do to a policy?</li>
  <li>Makes the <code>&quot;Resource&quot;:&quot;*&quot;</code> the policy always applicable?</li>
  </ol>