Policy

The Policy resource lets you create and manage AWS IAM Policies that define permissions for AWS services and resources.

Minimal Example

Create a basic policy that allows S3 bucket access:

import { Policy } from "alchemy/aws";

const s3Policy = await Policy("bucket-access", {
  policyName: "s3-bucket-access",
  document: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Action: ["s3:GetObject", "s3:PutObject"],
        Resource: `${bucket.arn}/*`,
      },
    ],
  },
});

Multiple Statements

Create a policy with multiple statements and conditions:

import { Policy } from "alchemy/aws";

const apiPolicy = await Policy("api-access", {
  policyName: "api-gateway-access",
  document: {
    Version: "2012-10-17",
    Statement: [
      {
        Sid: "InvokeAPI",
        Effect: "Allow",
        Action: "execute-api:Invoke",
        Resource: `${api.executionArn}/*`,
        Condition: {
          StringEquals: {
            "aws:SourceVpc": vpc.id,
          },
        },
      },
      {
        Sid: "ReadLogs",
        Effect: "Allow",
        Action: ["logs:GetLogEvents", "logs:FilterLogEvents"],
        Resource: `${api.logGroupArn}:*`,
      },
    ],
  },
  description: "Allows invoking API Gateway endpoints and reading logs",
  tags: {
    Service: "API Gateway",
    Environment: "production",
  },
});

Deny Policy

Create a policy that denies access based on tags:

import { Policy } from "alchemy/aws";

const denyPolicy = await Policy("deny-production", {
  policyName: "deny-production-access",
  document: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Deny",
        Action: "*",
        Resource: "*",
        Condition: {
          StringEquals: {
            "aws:ResourceTag/Environment": "production",
          },
        },
      },
    ],
  },
});