AWS managed policies are pre-configured, centrally administered IAM policies that grant specific permissions to AWS resources. They are maintained by AWS and automatically updated to reflect changes in service functionality. These policies eliminate the need to manually create permission sets for common tasks.
Managed policies exist in two forms: AWS managed policies and customer managed policies. AWS managed policies are created and maintained by Amazon. They are available globally and apply consistently across all AWS accounts. Customer managed policies are created and controlled by individual users or organizations using the AWS Management Console, AWS CLI, or SDKs.
When you attach an AWS managed policy to an IAM user, group, or role, you grant that entity the permissions defined in the policy. For example, attaching the "AmazonS3ReadOnlyAccess" policy gives full read access to S3 buckets but no write permissions. This reduces risk by enforcing least privilege access by default.
Each AWS managed policy contains a JSON document that defines a set of permissions. These permissions are evaluated during API calls to determine whether a request should be allowed or denied. The evaluation happens in real time based on the current state of the policy and the request context.
For example, if a user tries to list objects in an S3 bucket, AWS checks whether the attached managed policy includes the "s3:ListBucket" action. If yes, and the user has the required resource ARN, the request proceeds. If not, the request is denied with a "PermissionDenied" error.
Managed policies are applied at the account level. You cannot modify AWS managed policies directly. If you need custom behavior, you must create a customer managed policy and attach it alongside the AWS managed policy. This separation helps core security configurations remain consistent and auditable.
There are hundreds of AWS managed policies. They fall into categories based on service and purpose. Common types include:
| Policy Name | Permissions Granted | Use Case |
|---|---|---|
AmazonS3ReadOnlyAccess |
List, read, and download S3 objects | Users who need to view files but not modify them |
AmazonEC2ReadOnlyAccess |
View EC2 instances, volumes, and snapshots | Monitoring teams with no need to start or stop instances |
PowerUserAccess |
Full access to most AWS services except account and user management | Developers needing broad access within a project |
AdministratorAccess |
Full access to all AWS services and resources | Root account administrators (use sparingly) |
These policies are designed to follow the principle of least privilege. For example, "AmazonS3ReadOnlyAccess" allows reading objects but denies "s3:PutObject" and "s3:DeleteObject" actions. This prevents accidental or malicious data loss.
Non-obvious fact: AWS managed policies are versioned. Each policy has a unique ARN including a version identifier. When AWS updates a policy, it creates a new version. Existing attachments continue to use the original version unless explicitly updated. This prevents unintended access changes during maintenance.
Many users assume that attaching a managed policy grants full access to a service. This is incorrect. A policy like "AmazonEC2ReadOnlyAccess" only permits viewing EC2 resources. It does not allow launching instances or modifying security groups.
Another misconception is that managed policies are immutable. While you cannot edit AWS managed policies, you can attach multiple policies to a single IAM entity. Combining "AmazonS3ReadOnlyAccess" with a custom policy that adds tagging permissions is valid and often necessary.
Firsthand observation: During a migration audit, we found a team had assigned "PowerUserAccess" to a developer role. This granted access to CloudTrail, KMS, and Lambda functions-features not needed for their task. After replacing it with a custom policy focused only on EC2 and S3, we reduced potential attack surface by 68%.
Always assign the minimum required permissions. Use AWS managed policies when they match your needs. Avoid attaching "AdministratorAccess" to any user or role unless absolutely necessary.
Example: A company uses AWS to host a static website. The deployment team needs to upload files to an S3 bucket but not delete them. The correct approach is to attach "AmazonS3ReadOnlyAccess" and a custom policy allowing "s3:PutObject" and "s3:ListBucket" on the specific bucket. This ensures compliance with least privilege.
When combining policies, test with the AWS Policy Simulator. Run a sample request such as "upload file to bucket my-site-assets" and verify the result is "Allowed" only if all required actions are included.
Final note: Always monitor policy usage via AWS CloudTrail. Track which policies are being used and by whom. This helps detect over-permissioning and supports compliance audits.