- [Seph] Hi, y'all, welcome back. In this session, we're going to spend just a little time looking at policies to understand what they do. Essentially, I just want to give you some practice reading policies to help get you a little more comfortable. I'm going to show you a couple of different policies, and then we'll go line by line to look at what the policy is saying for the associated user or users. My hope is that by the end of this time, you'll realize that you can get started with policies without having every aspect of every component committed to memory. Even if you don't know what a particular action means, you can see if and how that action can be taken. Let's get started. This first policy is for working with Amazon S3. I'll give you a little time to look at it before I start explaining it. Let's go line by line, looking at what this policy says. If you remember, to understand a policy, you need to understand its parts, and the parts of a policy can be remembered by E-PARC, which stands for Effect, Principal, Action, Resource and Condition. So let's look at each statement block and identify those components. Looking at the first block, when we look for the E or effect, we see that this effect is set to allow, which lets us know that this block is granting permissions, instead of denying them. Looking for the P or principal, we see that there isn't one. Since it's an optional section, we can go ahead and move on. The Effect is allowing us to do something. What is it allowing us to do? The A or action tells us it's allowing us to perform the S3 ListBucket action. Just so you know, this action controls read access for a particular bucket. Moving on to the R or resource, we see that this block is referencing the socialmediabucket1, Amazon S3 resource. Since there is no C or condition block, we're ready to put it all together. What we get is that this block is allowing us to S3 list bucket on the socialmediabucket1 S3 bucket, or in plainer language, we are being granted read permissions to the bucket named socialmediabucket1. See, that wasn't so difficult. Now, using the same E-PARC technique, let's look at this second block, this time I'll give you some more time and give you the answer in a bit. So what does it say? As we can see, there is still no P or C in this statement block, so we're just looking for the E, A and R. Those are telling us that we are allowed to S3*Object on the socialmediabucket1 S3 bucket. If you remember, the wildcard allows you to provide a sort of auto-complete. In this case, it is covering all object actions in S3, including list object, delete object, get object, and all other actions that end in object. Again, in plain language, this block is allowing all object actions in this S3 bucket. And if we put it all together, the policy is allowing us to read all objects in the bucket, as well as perform write actions in the objects in socialmediabucket1. See, that wasn't so difficult. Let's take a look at this second policy now. I'll give you some time to look it over before I go through it. So if we match up the sections with E-PARC, we see that there is no principal. The effect is allow, and it's allowing the user to take these three actions, start instances, stop instances, and describe tags. The resources the user is being given access to are instances for a particular account in the us-east-2 region, also called the Ohio region. But this time, that's not the end of the story. This does not give them the ability to take actions on all of the instances in that particular region and account, but only the ones that have the DataAnalytics project tag. The creator of this policy is making sure to follow the grant least privilege practice in order to be as secure as possible. Taking the extra step to specify which instances a user can affect, based on their tags, provides boundaries to help avoid performing actions on unintended targets. That's it for our practice time here. Make sure you look in the course notes for a link to additional examples in the AWS documentation. And after you've gotten some more practice in reading policies on your own, Alana will be here to help you get started with writing policies. Bye for now.