Renting the world's computers
AWS rents out servers, storage and databases by the second, in regions (like Mumbai, ap-south-1) each made of several availability zones — separate data centres, so one fire doesn't take you down. Every single API call is checked by IAM: who is asking, to do what, to which resource.
IAM is the hotel key-card system: your card opens your room and the gym, never the manager's office — and the front desk can revoke it in a second.
How AWS evaluates a policy
- Everything is denied by default.
- A matching Allow statement grants access…
- …unless any matching Deny exists — explicit deny always wins.
- * is a wildcard in actions (s3:Get*) and resources (ARNs).
const globToRegExp = (pattern) =>
new RegExp(`^${pattern.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`);
const matches = (patterns, value) => [].concat(patterns).some((p) => globToRegExp(p).test(value));
function isAllowed(policies, action, resource) {
let allowed = false; // default: deny
for (const policy of policies) {
for (const s of policy.Statement) {
if (!matches(s.Action, action) || !matches(s.Resource, resource)) continue;
if (s.Effect === "Deny") return false; // an explicit deny always wins
if (s.Effect === "Allow") allowed = true;
}
}
return allowed;
}