Loading...
The structured files that spell out exactly who may do what in your cloud.
Quick Definition
A JSON policy document is a structured definition of permissions or rules written in JSON, widely used in cloud IAM and governance. It specifies who can do what to which resources under what conditions, enabling precise, machine-readable access and policy control.
A JSON policy document is a permissions definition written in JSON, the bracketed text format cloud platforms use for structured data. In IAM systems, each policy lists statements with three core parts: the effect (allow or deny), the actions covered, and the resources they apply to, often plus conditions like source network or time.
The format's strength is precision and reviewability. A policy either grants an action on a resource or it does not; there is no ambiguity for an auditor to argue about. Because policies are plain text, they live in version control, go through pull-request review, and get tested before deployment, the same lifecycle as application code.
Example. A policy allows a reporting service to read one specific storage bucket and nothing else. When a developer requests broader access in review, the diff makes the expansion visible and the team scopes it back before merge.
Common pitfalls are wildcards that grant far more than intended and policies that accumulate without review. Lint policies automatically and audit quarterly. The cloud security overview covers how permissions connect to governance and spend.
It is machine-readable, human-reviewable, and supported natively by cloud IAM systems. Some tools layer friendlier languages on top that compile to JSON.
An asterisk matches everything in its position, all actions or all resources. Wildcards are convenient and dangerous; scope them deliberately.
An explicit deny overrides any allow. Denies are used as guardrails, such as blocking actions outside approved regions regardless of other permissions.