A stored policy grants nothing. It starts to count when it is attached to a user, a group or a role, and it is attached by its ARN.
To a user
sh
aws iam attach-user-policy --user-name dana --policy-arn arn:aws:iam::123456789012:policy/ReportsReadThe ARN is the one create-policy printed: the account, then policy/ and the name.
To a group
sh
aws iam attach-group-policy --group-name analysts --policy-arn arn:aws:iam::123456789012:policy/ReportsReadEvery member of analysts gets the policy's permissions, including users who join later. One policy can be attached to many users and groups at once.
Where a user's permissions come from
sam's own policies
attached to samthe policies of sam's groups
attached to each groupall of them togetherwhat IAM evaluates
IAM adds up every policy attached to the user and every policy attached to each group the user is in. If any of them allows the action, the user may perform it (the next lessons add the exceptions).
sh
aws iam list-attached-user-policies --user-name samjson
{
"AttachedPolicies": []
}This lists only the policies attached directly to sam. Empty does not mean sam may do nothing: sam's groups may carry policies of their own.