title: “IAM Managed vs Inline Policies” created: 2026-07-22 updated: 2026-07-22 type: knowledge tags:
- aws
- iam
- security
- certification
IAM Managed vs Inline Policies
What It Is
IAM supports two main categories of policies for granting permissions:
- Managed Policies — Standalone policies that can be attached to multiple users, groups, or roles
- Inline Policies — Policies embedded directly into a single user, group, or role
Why It Matters
Choosing the right policy type affects maintainability, reusability, and auditability. This is a frequent topic on certification exams, and understanding the distinction helps design proper permission architectures.
Key Concepts
Managed Policies
There are two sub-types:
| Type | Created By | Examples |
|---|---|---|
| AWS Managed | AWS | AmazonS3ReadOnlyAccess, AmazonEC2ReadOnlyAccess |
| Customer Managed | You | Custom policies tailored to your needs |
Characteristics:
- Reusable: attach to multiple entities
- Versioned: up to 5 versions, can roll back
- Central updates: changing the policy immediately affects all attached entities
- Visible in the IAM Policies list
- Maximum of 10 managed policies per user/group/role (default)
Inline Policies
Characteristics:
- Embedded: lives inside a specific user, group, or role
- Not reusable: exists only for that one entity
- Deleted when the entity is deleted
- Useful for one-off, strict 1-to-1 permission relationships
- Not visible in the central IAM Policies list
When to Use Each
| Scenario | Policy Type |
|---|---|
| Standard permissions for a job function | AWS Managed |
| Company-specific standard permissions | Customer Managed |
| One-off permission for a specific entity | Inline |
| Permissions that must never accidentally apply elsewhere | Inline |
Example from the Lab
- EC2-Support group →
AmazonEC2ReadOnlyAccess(AWS Managed Policy) - S3-Support group →
AmazonS3ReadOnlyAccess(AWS Managed Policy) - EC2-Admin group →
EC2-Admin-Policy(Inline Policy granting Describe + Start + Stop)
Gotchas
- AWS Managed Policies can be overly broad — always review the JSON before attaching
- Inline policies are harder to audit at scale (not listed centrally)
- Deleting a group/user/role also deletes its inline policies permanently
- You cannot attach an inline policy to multiple entities — if you need that, convert to a customer managed policy
See Also
- [[iam-policy-structure]]
- [[iam-groups]]
- [[iam-users]]
- [[s3-bucket-policies]]