Summary

This chapter discussed the different types of access policies used in AWS. These included SCPs, identity-based policies, resource-based policies, and permissions boundaries. You saw some of the granular constructs of creating policies, especially in the case of conditions, and how you can use those constructs to narrow down the scope of the permissions of a policy to the least-privileged access.

You also reviewed how to provide access to a secondary account using roles rather than separate accounts. Using this method can allow you to provide access to third parties who need access to your account for a specific reason and already have their own AWS accounts and IAM users. In addition to using roles, you also learned how using ACLs can enable cross-account access for different types of resources.

In Chapter 15, Federated and Mobile Access, you will examine what federated access is as well as how to allow access to your account from mobile devices using identity providers...