# Policy summaries The IAM console includes *policy summary* tables that describe the access level, resources, and conditions that are allowed or denied for each service in a policy. Policies are summarized in three tables: the [policy summary](access_policies_understand-policy-summary.md), the [service summary](access_policies_understand-service-summary.md), and the [action summary](access_policies_understand-action-summary.md). The *policy summary* table includes a list of services. Choose a service there to see the *service summary*. This summary table includes a list of the actions and associated permissions for the chosen service. You can choose an action from that table to view the *action summary*. This table includes a list of resources and conditions for the chosen action. ![\[Policy summaries diagram image that illustrates the 3 tables and their relationship\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policy_summaries-diagram.png) You can view policy summaries on the **Users** page or **Roles** page for all policies (managed and inline) that are attached to that user. View summaries on the **Policies** page for all managed policies. Managed policies include AWS managed policies, AWS managed job function policies, and customer managed policies. You can view summaries for these policies on the **Policies** page regardless of whether they are attached to a user or other IAM identity. You can use the information in the policy summaries to understand the permissions that are allowed or denied by your policy. Policy summaries can help you [troubleshoot](troubleshoot_policies.md) and fix policies that are not providing the permissions that you expect. **Topics** + [Policy summary (list of services)](access_policies_understand-policy-summary.md) + [Access levels in policy summaries](access_policies_understand-policy-summary-access-level-summaries.md) + [Service summary (list of actions)](access_policies_understand-service-summary.md) + [Action summary (list of resources)](access_policies_understand-action-summary.md) + [Examples of policy summaries](access_policies_policy-summary-examples.md) # Policy summary (list of services) Policies are summarized in three tables: the policy summary, the [service summary](access_policies_understand-service-summary.md), and the [action summary](access_policies_understand-action-summary.md). The *policy summary* table includes a list of services and summaries of the permissions that are defined by the chosen policy. ![\[Policy summaries diagram image that illustrates the 3 tables and their relationship\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policy_summaries-pol-sum.png) The policy summary table is grouped into one or more **Uncategorized services**, **Explicit deny**, and **Allow** sections. If the policy includes a service that IAM does not recognize, then the service is included in the **Uncategorized services** section of the table. If IAM recognizes the service, then it is included under the **Explicit deny** or **Allow** sections of the table, depending on the effect of the policy (`Deny` or `Allow`). ## Understanding the elements of a policy summary In the following example of a policy details page, the **SummaryAllElements** policy is a managed policy (customer managed policy) that is attached directly to the user. This policy is expanded to show the policy summary. ![\[Policy summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-user-page-dialog.png) In the preceding image, the policy summary is visible from within the **Policies** page: 1. The **Permissions** tab includes the permissions defined in the policy. 1. If the policy does not grant permissions to all the actions, resources, and conditions defined in the policy, then a warning or error banner appears at the top of the page. The policy summary then includes details about the problem. To learn how policy summaries help you to understand and troubleshoot the permissions that your policy grants, see [My policy does not grant the expected permissions](troubleshoot_policies.md#policy-summary-not-grant-permissions). 1. Use the **Summary** and **JSON** buttons to toggle between the policy summary and the JSON policy document. 1. Use the **Search** box to reduce the list of services and find a specific service. 1. The expanded view shows additional details of the **SummaryAllElements** policy. The following policy summary table image shows the expanded **SummaryAllElements** policy on the policy details page. ![\[Policy summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-table-dialog.png) In the preceding image, the policy summary is visible from within the **Policies** page: 1. For those services that IAM recognizes, it arranges services according to whether the policy allows or explicitly denies the use of the service. In this example, the policy includes a `Deny` statement for the Amazon S3 service and `Allow` statements for the Billing, CodeDeploy, and Amazon EC2 services. 1. **Service** – This column lists the services that are defined within the policy and provides details for each service. Each service name in the policy summary table is a link to the *service summary* table, which is explained in [Service summary (list of actions)](access_policies_understand-service-summary.md). In this example, permissions are defined for the Amazon S3, Billing, CodeDeploy, and Amazon EC2 services. 1. **Access level** – This column tells whether the actions in each access level (`List`, `Read`, `Write`, `Permission Management`, and `Tagging`) have `Full` or `Limited` permissions defined in the policy. For additional details and examples of the access level summary, see [Access levels in policy summaries](access_policies_understand-policy-summary-access-level-summaries.md). + **Full access** – This entry indicates that the service has access to all actions within all four of the access levels available for the service. + If the entry does not include **Full access**, then the service has access to some but not all of the actions for the service. The access is then defined by following descriptions for each of the access level classifications (`List`, `Read`, `Write`, `Permission Management`, and `Tagging`): **Full**: The policy provides access to all actions within each access level classification listed. In this example, the policy provides access to all of the Billing `Read` actions. **Limited**: The policy provides access to one or more but not all actions within each access level classification listed. In this example, the policy provides access to some of the Billing `Write` actions. 1. **Resource** – This column shows the resources that the policy specifies for each service. + **Multiple** – The policy includes more than one but not all of the resources within the service. In this example, access is explicitly denied to more than one Amazon S3 resource. + **All resources** – The policy is defined for all resources within the service. In this example, the policy allows the listed actions to be performed on all Billing resources. + Resource text – The policy includes one resource within the service. In this example, the listed actions are allowed on only the `DeploymentGroupName` CodeDeploy resource. Depending on the information that the service provides to IAM, you might see an ARN or you might see the defined resource type. **Note** This column can include a resource from a different service. If the policy statement that includes the resource does not include both actions and resources from the same service, then your policy includes mismatched resources. IAM does not warn you about mismatched resources when you create a policy, or when you view a policy in the policy summary. If this column includes a mismatched resource, then you should review your policy for errors. To better understand your policies, always test them with the [policy simulator](access_policies_testing-policies.md). 1. **Request condition** – This column indicates whether the services or actions associated with the resource are subject to conditions. + **None** – The policy includes no conditions for the service. In this example no conditions are applied to the denied actions in the Amazon S3 service. + Condition text – The policy includes one condition for the service. In this example, the listed Billing actions are allowed only if the IP address of the source matches `203.0.113.0/24`. + **Multiple** – The policy includes more than one condition for the service. To view each of the multiple conditions for the policy, choose **JSON** to view the policy document. 1. **Show remaining services** – Toggle this button to expand the table to include the services that are not defined by the policy. These services are *implicitly denied* (or denied by default) within this policy. However, a statement in another policy might still allow or explicitly deny using the service. The policy summary summarizes the permissions of a single policy. To learn about how the AWS service decides whether a given request should be allowed or denied, see [Policy evaluation logic](reference_policies_evaluation-logic.md). When a policy or an element within the policy does not grant permissions, IAM provides additional warnings and information in the policy summary. The following policy summary table shows the expanded **Show remaining services** services on the **SummaryAllElements** policy details page with the possible warnings. ![\[Policy summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-table-showremaining-dialog.png) In the preceding image, you can see all services that include defined actions, resources, or conditions with no permissions: 1. **Resource warnings** – For services that do not provide permissions for all of the included actions or resources, you see one of the following warnings in the **Resource** column of the table: + **![\[Warning hazard sign icon with yellow triangle background.\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/console-alert-icon.console.png) No resources are defined.** – This means that the service has defined actions but no supported resources are included in the policy. + **![\[Warning hazard sign icon with yellow triangle background.\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/console-alert-icon.console.png) One or more actions do not have an applicable resource.** – This means that the service has defined actions, but that some of those actions don't have a supported resource. + **![\[Warning hazard sign icon with yellow triangle background.\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/console-alert-icon.console.png) One or more resources do not have an applicable action.** – This means that the service has defined resources, but that some of those resources don't have a supporting action. If a service includes both actions that do not have an applicable resource and resources that do have an applicable resource, then only the **One or more resources do not have an applicable action.** warning is shown. This is because when you view the service summary for the service, resources that do not apply to any action are not shown. For the `ListAllMyBuckets` action, this policy includes the last warning because the action does not support resource-level permissions, and does not support the `s3:x-amz-acl` condition key. If you fix either the resource problem or the condition problem, the remaining issue appears in a detailed warning. 1. **Request condition warnings** – For services that do not provide permissions for all of the included conditions, you see one of the following warnings in the **Request condition** column of the table: + **![\[Warning hazard sign icon with yellow triangle background.\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/console-alert-icon.console.png) One or more actions do not have an applicable condition.** – This means that the service has defined actions, but that some of those actions don't have a supported condition. + **![\[Warning hazard sign icon with yellow triangle background.\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/console-alert-icon.console.png) One or more conditions do not have an applicable action.** – This means that the service has defined conditions, but that some of those conditions don't have a supporting action. 1. **Multiple \$1 ![\[Warning hazard sign icon with yellow triangle background.\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/console-alert-icon.console.png) One or more actions do not have an applicable resource.** – The `Deny` statement for Amazon S3 includes more than one resource. It also includes more than one action, and some actions support the resources and some do not. To view this policy, see [**SummaryAllElements** JSON policy document](#policy-summary-example-json). In this case, the policy includes all Amazon S3 actions, and only the actions that can be performed on a bucket or bucket object are denied. 1. **![\[Warning hazard sign icon with yellow triangle background.\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/console-alert-icon.console.png) No resources are defined** – The service has defined actions, but no supported resources are included in the policy, and therefore the service provides no permissions. In this case, the policy includes CodeCommit actions but no CodeCommit resources. 1. **DeploymentGroupName \$1 string like \$1 All, region \$1 string like \$1 us-west-2 \$1 ![\[Warning hazard sign icon with yellow triangle background.\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/console-alert-icon.console.png) One or more actions do not have an applicable resource.** – The service has a defined action, and at least one more action that does not have a supporting resource. 1. **None \$1 ![\[Warning hazard sign icon with yellow triangle background.\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/console-alert-icon.console.png) One or more conditions do not have an applicable action.** – The service has at least one condition key that does not have a supporting action. ## **SummaryAllElements** JSON policy document The **SummaryAllElements** policy is not intended for you to use to define permissions in your account. Rather, it is included to demonstrate the errors and warnings that you might encounter while viewing a policy summary. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "billing:Get*", "payments:List*", "payments:Update*", "account:Get*", "account:List*", "cur:GetUsage*" ], "Resource": [ "*" ], "Condition": { "IpAddress": { "aws:SourceIp": "203.0.113.0/24" } } }, { "Effect": "Deny", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::customer", "arn:aws:s3:::customer/*" ] }, { "Effect": "Allow", "Action": [ "ec2:GetConsoleScreenshots" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "codedploy:*", "codecommit:*" ], "Resource": [ "arn:aws:codedeploy:us-west-2:123456789012:deploymentgroup:*", "arn:aws:codebuild:us-east-1:123456789012:project/my-demo-project" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:GetObject", "s3:DeletObject", "s3:PutObject", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::amzn-s3-demo-bucket", "arn:aws:s3:::amzn-s3-demo-bucket/*", "arn:aws:autoscling:us-east-2:123456789012:autoscalgrp" ], "Condition": { "StringEquals": { "s3:x-amz-acl": [ "public-read" ], "s3:prefix": [ "custom", "other" ] } } } ] } ``` ------ # View policy summaries You can view the policy summaries for any policies that are attached to an IAM user or role. For managed policies, you can view policy summaries on the **Policies** page. If your policy does not include a policy summary, see [Missing policy summary](troubleshoot_policies.md#missing-policy-summary) to learn why. ## Viewing policy summaries from the **Policies** page You can view the policy summary for managed policies on the **Policies** page. **To view the policy summary from the **Policies** page** 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 1. In the navigation pane, choose **Policies**. 1. In the list of policies, choose the name of the policy that you want to view. 1. On the **Policy details** page for the policy, view the **Permissions** tab to see the policy summary. ## Viewing a policy summary for a policy attached to a user You can view the policy summary for any policies that are attached to an IAM user. **To view the summary for a policy attached to a user** 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 1. Choose **Users** from the navigation pane. 1. In the list of users, choose the name of the user whose policy you want to view. 1. On the **Summary** page for the user, view the **Permissions** tab to see the list of policies that are attached to the user directly or from a group. 1. In the table of policies for the user, expand the row of the policy that you want to view. ## Viewing a policy summary for a policy attached to a role You can view the policy summary for any policies that are attached to a role. **To view the summary for a policy attached to a role** 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 1. In the navigation pane, choose **Roles**. 1. In the list of roles, choose the name of the role whose policy you want to view. 1. On the **Summary** page for the role, view the **Permissions** tab to see the list of policies that are attached to the role. 1. In the table of policies for the role, expand the row of the policy that you want to view. ## Editing policies to fix warnings While viewing a policy summary, you might find a typo or notice that the policy does not provide the permissions that you expected. You cannot edit a policy summary directly. However, you can edit a customer managed policy using the visual policy editor, which catches many of the same errors and warnings that the policy summary reports. You can then view the changes in the policy summary to confirm that you fixed all of the issues. To learn how to edit an inline policy, see [Edit IAM policies](access_policies_manage-edit.md). You cannot edit AWS managed policies. You can edit a policy for your policy summary using the **Visual** option. **To edit a policy for your policy summary using the **Visual** option** 1. Open the policy summary as explained in the previous procedures. 1. Choose **Edit**. If you are on the **Users** page and choose to edit a customer managed policy that is attached to that user, you are redirected to the **Policies** page. You can edit customer managed policies only on the **Policies** page. 1. Choose the **Visual** option to view the editable visual representation of your policy. IAM might restructure your policy to optimize it for the visual editor and to make it easier for you to find and fix any problems. The warnings and error messages on the page can guide you to fix any issues with your policy. For more information about how IAM restructures policies, see [Policy restructuring](troubleshoot_policies.md#troubleshoot_viseditor-restructure). 1. Edit your policy and choose **Next** to see your changes reflected in the policy summary. If you still see a problem, choose **Previous** to return to the editing screen. 1. Choose **Save changes** to save your changes. You can edit a policy for your policy summary using the **JSON** option. **To edit a policy for your policy summary using the **JSON** option** 1. Open the policy summary as explained in the previous procedures. 1. You can use the **Summary** and **JSON** buttons to compare the policy summary to the JSON policy document. You can use this information to determine which lines in the policy document you want to change. 1. Choose **Edit** and then choose the **JSON** option to edit the JSON policy document. **Note** You can switch between the **Visual** and **JSON** editor options any time. However, if you make changes or choose **Next** in the **Visual** editor option, IAM might restructure your policy to optimize it for the visual editor. For more information, see [Policy restructuring](troubleshoot_policies.md#troubleshoot_viseditor-restructure). If you are on the **Users** page and choose to edit a customer managed policy that is attached to that user, you are redirected to the **Policies** page. You can edit customer managed policies only on the **Policies** page. 1. Edit your policy. Resolve any security warnings, errors, or general warnings generated during [policy validation](access_policies_policy-validator.md), and then choose **Next**. If you still see a problem, choose **Previous** to return to the editing screen. 1. Choose **Save changes** to save your changes. # Access levels in policy summaries ## AWS access level summary Policy summaries include an access level summary that describes the action permissions defined for each service that is mentioned in the policy. To learn about policy summaries, see [Policy summaries](access_policies_understand.md). Access level summaries indicate whether the actions in each access level (`List`, `Read`, `Tagging`, `Write`, and `Permissions management`) have `Full` or `Limited` permissions defined in the policy. To view the access level classification that is assigned to each action in a service, see [Actions, Resources, and Condition Keys for AWS Services](reference_policies_actions-resources-contextkeys.html). The following example describes the access provided by a policy for the given services. For examples of full JSON policy documents and their related summaries, see [Examples of policy summaries](access_policies_policy-summary-examples.md). **** | Service | Access level | This policy provides the following | | --- | --- | --- | | IAM | Full access | Access to all actions within the IAM service. | | CloudWatch | Full: List | Access to all CloudWatch actions in the List access level, but no access to actions with the Read, Write, or Permissions management access level classification. | | Data Pipeline | Limited: List, Read | Access to at least one but not all AWS Data Pipeline actions in the List and Read access level, but not the Write or Permissions management actions. | | EC2 | Full: List, Read Limited: Write | Access to all Amazon EC2 List and Read actions and access to at least one but not all Amazon EC2 Write actions, but no access to actions with the Permissions management access level classification. | | S3 | Limited: Read, Write, Permissions management | Access to at least one but not all Amazon S3 Read, Write and Permissions management actions. | | codedploy | (empty) | Unknown access, because IAM does not recognize this service. | | API Gateway | None | No access is defined in the policy. | | CodeBuild | ![\[a white exclamation point on an orange triangle background\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/console-alert-icon.console.png) No actions are defined. | No access because no actions are defined for the service. To learn how to understand and troubleshoot this issue, see [My policy does not grant the expected permissions](troubleshoot_policies.md#policy-summary-not-grant-permissions). | In a policy summary, **Full access** indicates that the policy provides access to all the actions within the service. Policies that provide access to some but not all actions within a service are further grouped according to the access level classification. This is indicated by one of the following access-level groupings: + **Full**: The policy provides access to all actions within the specified access level classification. + **Limited**: The policy provides access to one or more but not all actions within the specified access level classification. + **None**: The policy provides no access. + (empty): IAM does not recognize this service. If the service name includes a typo, then the policy provides no access to the service. If the service name is correct, then the service might not support policy summaries or might be in preview. In this case, the policy might provide access, but that access cannot be shown in the policy summary. To request policy summary support for a generally available (GA) service, see [Service does not support IAM policy summaries](troubleshoot_policies.md#unsupported-services-actions). Access level summaries that include limited (partial) access to actions are grouped using the AWS access level classifications `List`, `Read`, `Tagging`, `Write`, or `Permissions management`. ## AWS access levels AWS defines the following access level classifications for the actions in a service: + **List**: Permission to list resources within the service to determine whether an object exists. Actions with this level of access can list objects but cannot see the contents of a resource. For example, the Amazon S3 action `ListBucket` has the **List** access level. + **Read**: Permission to read but not edit the contents and attributes of resources in the service. For example, the Amazon S3 actions `GetObject` and `GetBucketLocation` have the **Read** access level. + **Tagging**: Permission to perform actions that only change the state of resource tags. For example, the IAM actions `TagRole` and `UntagRole` have the **Tagging** access level because they allow only tagging or untagging a role. However, the `CreateRole` action allows tagging a role resource when you create that role. Because the action does not only add a tag, it has the `Write` access level. + **Write**: Permission to create, delete, or modify resources in the service. For example, the Amazon S3 actions `CreateBucket`, `DeleteBucket` and `PutObject` have the **Write** access level. `Write` actions might also allow modifying a resource tag. However, an action that allows only changes to tags has the `Tagging` access level. + **Permissions management**: Permissions management refers to actions that control access within AWS services, including IAM and non-IAM identity permissions, but excludes network-level access controls like security groups. For example, most IAM and AWS Organizations actions, as well as the Amazon S3 actions `PutBucketPolicy` and `DeleteBucketPolicy` have the **Permissions management** access level. **Tip** To improve the security of your AWS account, restrict or regularly monitor policies that include the **Permissions management** access level classification. To view the access level classification for all of the actions in a service, see [Actions, Resources, and Condition Keys for AWS Services](reference_policies_actions-resources-contextkeys.html). # Service summary (list of actions) Policies are summarized in three tables: the [policy summary](access_policies_understand-policy-summary.md), the service summary, and the [action summary](access_policies_understand-action-summary.md). The *service summary* table includes a list of the actions and summaries of the permissions that are defined by the policy for the chosen service. ![\[Policy summaries diagram image that illustrates the 3 tables and their relationship\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policy_summaries-svc-sum.png) You can view a service summary for each service listed in the policy summary that grants permissions. The table is grouped into **Uncategorized actions**, **Uncategorized resource types**, and access level sections. If the policy includes an action that IAM does not recognize, then the action is included in the **Uncategorized actions** section of the table. If IAM recognizes the action, then it is included under one of the access level (**List**, **Read**, **Write** and **Permissions management**) sections of the table. To view the access level classification that is assigned to each action in a service, see [Actions, Resources, and Condition Keys for AWS Services](reference_policies_actions-resources-contextkeys.html). ## Understanding the elements of a service summary The example below is the service summary for Amazon S3 actions that are allowed from a policy summary. The actions for this service are grouped by access level. For example, 35 **Read** actions are defined out of the total 52 **Read** actions available for the service. ![\[Service summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-action-dialog.png) The service summary page for a managed policy includes the following information: 1. If the policy does not grant permissions to all the actions, resources, and conditions defined for the service in the policy, then a warning banner appears at the top of the page. The service summary then includes details about the problem. To learn how policy summaries help you to understand and troubleshoot the permissions that your policy grants, see [My policy does not grant the expected permissions](troubleshoot_policies.md#policy-summary-not-grant-permissions). 1. Choose **JSON** to see additional details about the policy. You can do this to view all conditions that are applied to the actions. (If you are viewing the service summary for an inline policy that is attached directly to a user, you must close the service summary dialog box and return to the policy summary to access the JSON policy document.) 1. To view the summary for a specific action, type keywords into the **Search** box to reduce the list of available actions. 1. Next to the **Services** back arrow appears the name of the service (in this case **S3**). The service summary for this service includes the list of allowed or denied actions that are defined in the policy. If the service appears under **(Explicit deny)** on the **Permissions** tab, then the actions listed in the service summary table are explicitly denied. If the service appears under **Allow** on the **Permissions** tab, then the actions listed in the service summary table are allowed. 1. **Action** – This column lists the actions that are defined within the policy and provides the resources and conditions for each action. If the policy grants or denies permissions to the action, then the action name links to the *[action summary](access_policies_understand-action-summary.md)* table. The table groups these actions into at least one or up to five sections, depending on the level of access that the policy allows or denies. The sections are **List**, **Read**, **Write**, **Permission Management**, and **Tagging**. The count indicates the number of recognized actions that provide permissions within each access level. The total is the number of known actions for the service. In this example, 35 actions provide permissions out of 52 total known Amazon S3 **Read** actions. To view the access level classification that is assigned to each action in a service, see [Actions, Resources, and Condition Keys for AWS Services](reference_policies_actions-resources-contextkeys.html). 1. **Show remaining actions** – Toggle this button to expand or hide the table to include actions that are known but do not provide permissions for this service. Toggling the button also displays warnings for any elements that do not provide permissions. 1. **Resource** – This column shows the resources that the policy defines for the service. IAM does not check whether the resource applies to each action. In this example, actions in the Amazon S3 service are allowed on only the `developer_bucket` Amazon S3 bucket resource. Depending on the information that the service provides to IAM, you might see an ARN such as `arn:aws:s3:::developer_bucket/*`, or you might see the defined resource type, such as `BucketName = developer_bucket`. **Note** This column can include a resource from a different service. If the policy statement that includes the resource does not include both actions and resources from the same service, then your policy includes mismatched resources. IAM does not warn you about mismatched resources when you create a policy, or when you view a policy in the service summary. IAM also does not indicate whether the action applies to the resources, only whether the service matches. If this column includes a mismatched resource, then you should review your policy for errors. To better understand your policies, always test them with the [policy simulator](access_policies_testing-policies.md). 1. **Request condition** – This column tells whether the actions associated with the resource are subject to conditions. To learn more about those conditions, choose **JSON** to review the JSON policy document. 1. **(No access) **– This policy includes an action that does not provide permissions. 1. **Resource warning** – For actions with resources that do not provide full permissions, you see one of the following warnings: + **This action does not support resource-level permissions. This requires a wildcard (\$1) for the resource.** – This means that the policy includes resource-level permissions but must include `"Resource": ["*"]` to provide permissions for this action. + **This action does not have an applicable resource.** – This means that the action is included in the policy without a supported resource. + **This action does not have an applicable resource and condition.** – This means that the action is included in the policy without a supported resource and without a supported condition. In this case, there is also condition included in the policy for this service, but there are no conditions that apply to this action. 1. Actions that provide permissions include a link to the action summary. # View service summaries You can view a service summary for each service listed in the policy summary that grants permissions. ## Viewing service summaries from the **Policies** page You can view the service summary for managed policies on the **Policies** page. **To view the service summary for a managed policy** 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 1. In the navigation pane, choose **Policies**. 1. In the list of policies, choose the name of the policy that you want to view. 1. On the **Policy details** page for the policy, view the **Permissions** tab to see the policy summary. 1. In the policy summary list of services, choose the name of the service that you want to view. ## Viewing a service summary for a policy attached to a user You can view the service summary for any policies that are attached to an IAM user. **To view the service summary for a policy attached to a user** 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 1. In the navigation pane, choose **Users**. 1. In the list of users, choose the name of the user whose policy you want to view. 1. On the **Summary** page for the user, view the **Permissions** tab to see the list of policies that are attached to the user directly or from a group. 1. In the table of policies for the user, choose the name of the policy that you want to view. If you are on the **Users** page and choose to view the service summary for a policy that is attached to that user, you are redirected to the **Policies** page. You can view service summaries only on the **Policies** page. 1. Choose **Summary**. In the policy summary list of services, choose the name of the service that you want to view. **Note** If the policy that you select is an inline policy that is attached directly to the user, then the service summary table appears. If the policy is an inline policy attached from a group, then you are taken to the JSON policy document for that group. If the policy is a managed policy, then you are taken to the service summary for that policy on the **Policies** page. ## Viewing a service summary for a policy attached to a role You can view the policy summary for any policies that are attached to a role. **To view the service summary for a policy attached to a role** 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 1. Choose **Roles** from the navigation pane. 1. In the list of roles, choose the name of the role whose policy you want to view. 1. On the **Summary** page for the role, view the **Permissions** tab to see the list of policies that are attached to the role. 1. In the table of policies for the role, choose the name of the policy that you want to view. If you are on the **Roles** page and choose to view the service summary for a policy that is attached to that user, you are redirected to the **Policies** page. You can view service summaries only on the **Policies** page. 1. In the policy summary list of services, choose the name of the service that you want to view. # Action summary (list of resources) Policies are summarized in three tables: the [policy summary](access_policies_understand-policy-summary.md), the [service summary](access_policies_understand-service-summary.md), and the action summary. The *action summary* table includes a list of resources and the associated conditions that apply to the chosen action. ![\[policy summaries diagram that illustrates the 3 tables and their relationship.\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policy_summaries-action-sum.png) To view an action summary for each action that grants permissions, choose the link in the service summary. The action summary table includes details about the resource, including its **Region** and **Account**. You can also view the conditions that apply to each resource. This shows you conditions that apply to some resources but not others. ## Understanding the elements of an action summary The example below is the action summary for the `PutObject` (Write) action from the Amazon S3 service summary (see [Service summary (list of actions)](access_policies_understand-service-summary.md)). For this action, the policy defines multiple conditions on a single resource. ![\[Action summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-resource-dialog.png) The action summary page includes the following information: 1. Choose **JSON** to see additional details about the policy, such as viewing the multiple conditions that are applied to the actions. (If you are viewing the action summary for an inline policy that is attached directly to a user, the steps differ. To access the JSON policy document in that case, you must close the action summary dialog box and return to the policy summary.) 1. To view the summary for a specific resource, type keywords into the **Search** box to reduce the list of available resources. 1. Next to the **Actions** back arrow appears the name of the service and action in the format `action name action in service` (in this case **PutObject action in S3**). The action summary for this service includes the list of resources that are defined in the policy. 1. **Resource** – This column lists the resources that the policy defines for the chosen service. In this example, the **PutObject** action is allowed on all object paths, but on only the `developer_bucket` Amazon S3 bucket resource. Depending on the information that the service provides to IAM, you might see an ARN such as `arn:aws:s3:::developer_bucket/*`, or you might see the defined resource type, such as `BucketName = developer_bucket, ObjectPath = All`. 1. **Region** – This column shows the Region in which the resource is defined. Resources can be defined for all Regions, or a single Region. They cannot exist in more than one specific Region. + **All regions** – The actions that are associated with the resource apply to all Regions. In this example, the action belongs to a global service, Amazon S3. Actions that belong to global services apply to all Regions. + Region text – The actions associated with the resource apply to one Region. For example, a policy can specify the `us-east-2` Region for a resource. 1. **Account** – This column indicates whether the services or actions associated with the resource apply to a specific account. Resources can exist in all accounts or a single account. They cannot exist in more than one specific account. + **All accounts** – The actions that are associated with the resource apply to all accounts. In this example, the action belongs to a global service, Amazon S3. Actions that belong to global services apply to all accounts. + **This account** – The actions that are associated with the resource apply only in the current account.. + Account number – The actions that are associated with the resource apply to one account (one that you are not currently logged in to). For example, if a policy specifies the `123456789012` account for a resource, then the account number appears in the policy summary. 1. **Request condition** – This column shows whether the actions that are associated with the resource are subject to conditions. This example includes the `s3:x-amz-acl = public-read` condition. To learn more about those conditions, choose **JSON** to review the JSON policy document. # View action summaries You can view an action summary for each action listed in the policy summary that grants permissions. ## Viewing action summaries from the **Policies** page You can view the action summary for managed policies. **To view the action summary for a managed policy** 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 1. In the navigation pane, choose **Policies**. 1. In the list of policies, choose the name of the policy that you want to view. 1. On the **Policy details** page for the policy, view the **Permissions** tab to see the policy summary. 1. In the policy summary list of services, choose the name of the service that you want to view. 1. In the service summary list of actions, choose the name of the action that you want to view. ## Viewing action summaries for a policy attached to a user You can view the action summary for any policy that is attached to a user. **To view the action summary for a policy attached to a user** 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 1. Choose **Users** from the navigation pane. 1. In the list of users, choose the name of the user whose policy you want to view. 1. On the **Summary** page for the user, view the **Permissions** tab to see the list of policies that are attached to the user directly or from a group. 1. In the table of policies for the user, choose the name of the policy that you want to view. If you are on the **Users** page and choose to view the service summary for a policy that is attached to that user, you are redirected to the **Policies** page. You can view service summaries only on the **Policies** page. 1. In the policy summary list of services, choose the name of the service that you want to view. **Note** If the policy that you select is an inline policy that is attached directly to the user, then the service summary table appears. If the policy is an inline policy attached from a group, then you are taken to the JSON policy document for that group. If the policy is a managed policy, then you are taken to the service summary for that policy on the **Policies** page. 1. In the service summary list of actions, choose the name of the action that you want to view. ## Viewing action summaries for a policy attached to a role You can view the action summary for any policy that is attached to a role. **To view the action summary for a policy attached to a role** 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 1. In the navigation pane, choose **Roles**. 1. In the list of roles, choose the name of the role whose policy you want to view. 1. On the **Summary** page for the role, view the **Permissions** tab to see the list of policies that are attached to the role. 1. In the table of policies for the role, choose the name of the policy that you want to view. If you are on the **Roles** page and choose to view the service summary for a policy that is attached to that user, you are redirected to the **Policies** page. You can view service summaries only on the **Policies** page. 1. In the policy summary list of services, choose the name of the service that you want to view. 1. In the service summary list of actions, choose the name of the action that you want to view. # Examples of policy summaries The following examples include JSON policies with their associated [policy summaries](access_policies_understand-policy-summary.md), the [service summaries](access_policies_understand-service-summary.md), and the [action summaries](access_policies_understand-action-summary.md) to help you understand the permissions given through a policy. ## Policy 1: DenyCustomerBucket This policy demonstrates an allow and a deny for the same service. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "FullAccess", "Effect": "Allow", "Action": ["s3:*"], "Resource": ["*"] }, { "Sid": "DenyCustomerBucket", "Action": ["s3:*"], "Effect": "Deny", "Resource": ["arn:aws:s3:::customer", "arn:aws:s3:::customer/*" ] } ] } ``` ------ ***DenyCustomerBucket** Policy Summary:* ![\[Policy summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-example1-dialog.png) ***DenyCustomerBucket S3 (Explicit deny)** Service Summary:* ![\[Service summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-action-example1-dialog.png) ***GetObject (Read)** Action Summary:* ![\[Action summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-resource-example1-dialog.png) ## Policy 2: DynamoDbRowCognitoID This policy provides row-level access to Amazon DynamoDB based on the user's Amazon Cognito ID. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DeleteItem", "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem" ], "Resource": [ "arn:aws:dynamodb:us-west-1:123456789012:table/myDynamoTable" ], "Condition": { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": [ "${cognito-identity.amazonaws.com:sub}" ] } } } ] } ``` ------ ***DynamoDbRowCognitoID** Policy Summary:* ![\[Policy summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-example2-dialog.png) ***DynamoDbRowCognitoID DynamoDB (Allow)** Service Summary:* ![\[Service summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-action-example2-dialog.png) ***GetItem (List)** Action Summary:* ![\[Action summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-resource-example2-dialog.png) ## Policy 3: MultipleResourceCondition This policy includes multiple resources and conditions. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": ["arn:aws:s3:::Apple_bucket/*"], "Condition": {"StringEquals": {"s3:x-amz-acl": ["public-read"]}} }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:PutObjectAcl" ], "Resource": ["arn:aws:s3:::Orange_bucket/*"], "Condition": {"StringEquals": { "s3:x-amz-acl": ["custom"], "s3:x-amz-grant-full-control": ["1234"] }} } ] } ``` ------ ***MultipleResourceCondition** Policy Summary:* ![\[Policy summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-example3-dialog.png) ***MultipleResourceCondition S3 (Allow)** Service Summary:* ![\[Service summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-action-example3-dialog.png) ***PutObject (Write)** Action Summary:* ![\[Action summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-resource-example3-dialog.png) ## Policy 4: EC2\$1troubleshoot The following policy allows users to get a screenshot of a running Amazon EC2 instance, which can help with EC2 troubleshooting. This policy also permits viewing information about the items in the Amazon S3 developer bucket. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:GetConsoleScreenshot" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::developer" ] } ] } ``` ------ ***EC2\$1Troubleshoot** Policy Summary:* ![\[Policy summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-example4-dialog.png) ***EC2\$1Troubleshoot S3 (Allow)** Service Summary:* ![\[Service summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-action-example4-dialog.png) ***ListBucket (List)** Action Summary:* ![\[Action summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-resource-example4-dialog.png) ## Policy 5: CodeBuild\$1CodeCommit\$1CodeDeploy This policy provides access to specific CodeBuild, CodeCommit, and CodeDeploy resources. Because these resources are specific to each service, they appear only with the matching service. If you include a resource that does not match any services in the `Action` element, then the resource appears in all action summaries. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "Stmt1487980617000", "Effect": "Allow", "Action": [ "codebuild:*", "codecommit:*", "codedeploy:*" ], "Resource": [ "arn:aws:codebuild:us-east-2:123456789012:project/my-demo-project", "arn:aws:codecommit:us-east-2:123456789012:MyDemoRepo", "arn:aws:codedeploy:us-east-2:123456789012:application:WordPress_App", "arn:aws:codedeploy:us-east-2:123456789012:instance/AssetTag*" ] } ] } ``` ------ ***CodeBuild\$1CodeCommit\$1CodeDeploy** Policy Summary:* ![\[Policy summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-example6-dialog.png) ***CodeBuild\$1CodeCommit\$1CodeDeploy CodeBuild (Allow)** Service Summary:* ![\[Service summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-action-example6-dialog.png) ***CodeBuild\$1CodeCommit\$1CodeDeploy StartBuild (Write)** Action Summary:* ![\[Action summary dialog image\]](http://docs.aws.amazon.com/IAM/latest/UserGuide/images/policies-summary-resource-example6-dialog.png)