# Appendix: Sample profile and role policies
<a name="appendix-sample-policies"></a>

## Sample policies for Application 1
<a name="appendix-sample-policies-app-1"></a>

The sample policy for **Profile 1** allows some actions for **Bucket 1** in Amazon Simple Storage Service (Amazon S3):

```
{
    "Version": "2012-10-17", 		 	 	 		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject",
                "s3:GetObjectTagging",
                "s3:GetObjectVersion"
            ],
            "Resource": [
                "arn:aws:s3:::amzn-s3-demo-bucket1",
                "arn:aws:s3:::amzn-s3-demo-bucket1/*"
            ]
        }
    ]
}
```

The sample policy for **Role 1** allows the `DescribeInstances` action for an Amazon Elastic Compute Cloud (Amazon EC2) instance and allows some actions on **Bucket 1** and **Bucket 2** in Amazon S3:

```
{
    "Version": "2012-10-17", 		 	 	 		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances"
            ],
            "Resource": [
                "arn:aws:ec2:us-east-1:123456789012:instance/i-01234567890abcdef"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:ListBucket",
                "s3:GetObject",
                "s3:GetObjectTagging",
                "s3:GetObjectVersion",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectLegalHold",
                "s3:PutObjectTagging"
            ],
            "Resource": [
                "arn:aws:s3:::amzn-s3-demo-bucket1",
                "arn:aws:s3:::amzn-s3-demo-bucket1/*",
                "arn:aws:s3:::amzn-s3-demo-bucket2",
                "arn:aws:s3:::amzn-s3-demo-bucket2/*"
            ]
        }
    ]
}
```

The **Profile 1** policy limits the permissions granted by the **Role 1** policy. It is applied to the role session when the role is assumed through IAM Roles Anywhere. An application that assumes **Role 1** has access to only **Bucket 1**. It cannot access **Bucket 2** or perform any Amazon EC2 actions because the **Profile 1 **policy doesn't grant these permissions.

## Sample policies for Application 2
<a name="appendix-sample-policies-app-2"></a>

The sample policy for **Profile 2** allows some actions for **Bucket 2** in Amazon S3:

```
{
    "Version": "2012-10-17", 		 	 	 		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject",
                "s3:GetObjectTagging",
                "s3:GetObjectVersion"
            ],
            "Resource": [
                "arn:aws:s3:::amzn-s3-demo-bucket2",
                "arn:aws:s3:::amzn-s3-demo-bucket2/*"
            ]
        }
    ]
}
```

The sample policy for **Role 2** allows the `DescribeInstances` action for an Amazon EC2 instance and allows some actions on **Bucket 1** and **Bucket 2** in Amazon S3:

```
{
    "Version": "2012-10-17", 		 	 	 		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances"
            ],
            "Resource": [
                "arn:aws:ec2:us-east-1:567890123456:instance/i-05678901234ghijk"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:ListBucket",
                "s3:GetObject",
                "s3:GetObjectTagging",
                "s3:GetObjectVersion",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectLegalHold",
                "s3:PutObjectTagging"
            ],
            "Resource": [
                "arn:aws:s3:::amzn-s3-demo-bucket1",
                "arn:aws:s3:::amzn-s3-demo-bucket1/*",
                "arn:aws:s3:::amzn-s3-demo-bucket2",
                "arn:aws:s3:::amzn-s3-demo-bucket2/*"
            ]
        }
    ]
}
```

The policy for **Profile 2** limits the permissions granted by **Role 2**. It is applied to the role session when the role is assumed through IAM Roles Anywhere. An application that assumes **Role 2** has access to only **Bucket 2**. It cannot access **Bucket 1** or perform Amazon EC2 actions because the **Profile 2 **policy doesn't grant these permissions.