Types of IAM Policies

Impossible Cloud supports IAM policies that allow its users to have granular control over the use, access and administration of their cloud storage. Currently the Impossible Cloud Console can manage the following types of policies:

• Managed Policies

• IC Managed Policies

• Inline Policies

An inline policy is attached directly to a specific IAM user. If that user is deleted, the inline policy is deleted too, it can’t be reused.

A managed policy exists as its own separate item in IAM. If the group or user it’s linked to is deleted, the policy still exists and can be attached to another IAM user.

1. Managed Policies

Managed Policies are a reusable set of permissions that you can attach to multiple users or groups to control what actions they can perform. Impossible Cloud allows you to have custom policies created and managed by you. Customer managed policies offer greater flexibility as you can define specific permissions based on your requirements. You can also reuse these policies across multiple users or groups within your ICSC environment.

You can either put this in a .JSON file and attach it via CLI, or create it in the ICSC console under “Policies” using the Visual Policy Builder or the JSON editor. A Managed Policy can look like this:

File example: my-impossible-cloud-policy.json

{
  "Statement": [
    {
      "Action": [
        "s3:ListAllMyBuckets",
        "s3:PutObject",
        "s3:ListBucket"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::my-impossible-cloud-bucket",
        "arn:aws:s3:::my-impossible-cloud-bucket/*"
      ],
      "Sid": "AllowCommonS3Actions"
    }
  ],
  "Version": "2012-10-17"
}

This policy lets the assigned user(s) see and upload files to the bucket "my-impossible-cloud-bucket". However it restricts their permission to download or delete any objects within.

Remember to configure your profile:

aws configure --profile your-profile-name

To attach that Managed Policy to an IAM User using CLI, you can write:

aws iam create-policy \
  --policy-name MyICPolicy \
  --policy-document file://my-impossible-cloud-policy.json \
  --endpoint-url https://iam.impossibleapi.net \
  --profile your-profile-name
 
aws iam attach-user-policy \
  --user-name "[e-mail]" \
  --policy-arn arn:aws:iam::123456789012:policy/MyICPolicy \
  --endpoint-url https://iam.impossibleapi.net/ 
  --profile your-profile-name

2. IC Managed Policies

IC Managed Policies are pre-defined and maintained by Impossible Cloud. They provide ready-to-use permission sets that can be attached to IAM users and groups.

Use IC Managed Policies when you want a standardized policy maintained by Impossible Cloud, instead of creating and maintaining your own custom managed policy.

How to access IC Managed Policies

You can access IC Managed Policies via:

• CLI: Use IAM policy discovery commands against the IAM endpoint to list and inspect available managed policies.

IC managed policies use the path prefix /ic and their ARNs do not include an account ID.

CLI examples

List policies:

Use the AWS scope value for provider-managed policies:

aws iam list-policies \
  --scope AWS \
  --endpoint-url https://iam.impossibleapi.net \
  --profile your-profile-name

Attach a selected policy to a user:

aws iam attach-user-policy \
  --user-name "[e-mail]" \
  --policy-arn arn:aws:iam::1:policy/ICManagedPolicyName \
  --endpoint-url https://iam.impossibleapi.net \
  --profile your-profile-name

Tip: For IC managed policies, keep the account ID 1 in the policy ARN and replace only ICManagedPolicyName.

3. Inline Policies

Inline policies are directly embedded into a single IAM user or group. These type of policies have the following conditions:

• Directly Attached: When you create an inline policy, it becomes part of that specific user or group.

• Unique to the Identity: It cannot be attached to any other user or group.

• No Versioning: Unlike managed policies, inline policies do not have versioning, meaning you can't easily roll back to a previous version of the policy.

• Lifecycle: If you delete the IAM identity, the inline policy is also automatically deleted.

Note: While inline policies provide granular control, they are not reusable across different users or groups like the Managed Policies.

You can assign inline policies via CLI like this:

aws iam put-user-policy \
  --user-name "[e-mail]" \
  --policy-name CustomInlinePolicy \
  --policy-document file://my-impossible-cloud-policy.json \
  --endpoint-url https://iam.impossibleapi.net/ \
  --profile your-profile-name

Alternatively, this can be done in the UI in the User > Select User > Inline Policies section.