AWS IAM Policies in a Nutshell
Q: do you apply policy on roles, resources, or both? How do you maintain mental sanity?We use 1 base policy + 1 policy/role, and so for each role it's easy to see what are its permissions.We have no policy on resources, so it's hard, e.g., given a bucket to know who has access to it. We're building tooling for that.edit: grammar/typos