AWS IAM Policies in a Nutshell
Q: do you apply policy on roles, resources, or both? How do you maintain mental sanity?<p>We use 1 base policy + 1 policy/role, and so for each role it's easy to see what are its permissions.<p>We have no policy on resources, so it's hard, e.g., given a bucket to know who has access to it. We're building tooling for that.<p>edit: grammar/typos