IAM, policies, CLI, roles and the AWS SDK

Why and what

IAM answers who may perform which action on which resource under which conditions. A user is a persistent identity; a role is assumed and supplies temporary credentials. A role trust policy controls who can assume it, while its permissions policies control what the assumed role can do. An instance profile attaches a role to EC2. Authentication success does not guarantee authorization for every API call.

Policy example

For a lab bucket, grant only object read/write under reels/. Replace the bucket name before creating the policy.

{
  "Version":"2012-10-17",
  "Statement":[{
    "Effect":"Allow",
    "Action":["s3:GetObject","s3:PutObject"],
    "Resource":"arn:aws:s3:::YOUR_UNIQUE_BUCKET/reels/*"
  }]
}

This does not permit listing the bucket or accessing other prefixes. Listing requires a bucket ARN and, preferably, an s3:prefix condition. Explicit denies, organization policies, permissions boundaries, session policies and resource policies can further affect the final decision.

CLI lab

1. Install AWS CLI v2 using the official instructions for your OS/CPU.
2. For a workstation, configure an approved IAM Identity Center profile with aws configure sso, then sign in.
3. For EC2, attach a role with the lab permissions. Do not run aws configure to paste long-term keys onto the server.

aws --version
aws sts get-caller-identity
aws configure list
aws s3 cp lesson.txt s3://YOUR_UNIQUE_BUCKET/reels/lesson.txt

Expect an ARN identifying the actual assumed role. Environment variables or shared credential files can override the identity you expected; inspect the credential chain when the wrong account appears.

SDK concept

The SDK signs requests, retries eligible errors and serializes API data. In PHP, instantiate the S3 client with region/version and omit static credentials so the default provider chain can use the instance profile. Never put server AWS credentials into browser JavaScript. Presigned URLs grant temporary access to a particular operation and must be treated as bearer credentials.

Verification and failure lab

Upload to the permitted prefix, then try a different prefix and expect AccessDenied. Do not fix this by attaching AdministratorAccess. Inspect action, resource ARN, identity, region, bucket policy and KMS permissions if applicable. CloudTrail can help identify API failures.

Interview question

Why can an instance SSH successfully yet fail to write S3? SSH authenticates an OS user; S3 evaluates AWS IAM/API authorization.

Official references

IAM policy evaluation AWS CLI installation PHP credential providers

Interview and revision check

Why can an allowed identity policy still result in AccessDenied?

Explicit denies, resource policies, SCPs, boundaries, session policies, endpoint policies or encryption-key permissions may restrict the request.