Using the Access Policy Language

1

You write a policy for your resource.

For example, you write a policy to specify permissions for your Amazon S3 objects. For more information, see How to Write a Policy.

2

You upload your policy to AWS.

The AWS service itself provides an API you use to upload your policies. For example, you use the Amazon S3 PUT Bucket policy action to set a policy on a bucket.

3

Someone sends a request to use your resource.

For example, a user sends a request to Amazon S3 to upload an object to a bucket.

4

The AWS service determines which policies are applicable to the request.

For example, Amazon S3 looks at all the available Amazon S3 policies and determines which ones are applicable (based on what the resource is, who the requester is, etc.).

5

The AWS service evaluates the policies.

For example, Amazon S3 evaluates the policies and determines if the requester is allowed to upload the object to the bucket. For information about the decision logic, see Evaluation Logic.

6

The AWS service either denies the request or continues to process it.

For example, based on the policy evaluation result, the service either returns an "Access denied" error to the requester or continues to process the request.