If the system default policy cannot meet your needs, you can create a custom policy to enable more granular permission control for Identity and Access Management (IAM) users. This topic describes common scenarios related to Application Load Balancer (ALB) permission control and provides custom policy configuration examples for these scenarios. You can use either the visual editor or JSON editor to configure a custom policy.

For ALB policy description, see ALB policies. For custom policy creation procedure and more custom policy examples, see Create custom policy and IAM Policy Example.

Scenario 1: Deny an IAM user from creating a public ALB instance

If you need to restrict an IAM user from creating public ALB instances, follow the example below to create a custom policy.

The effect specified in the following custom policy is Deny. A Deny policy must be used in conjunction with an Allow policy to take effect. When both Allow and Deny policies are granted to an IAM user, the Deny policy takes precedence.

If you want an IAM user to perform all actions of ALB resources except creating public ALB instances, grant the system default policy (ALBFullAccess) along with the custom policy below.

Visual editor

JSON editor

Statement:

Effect: Click Deny.

Service: Select alb.

Action: In the Create resource and Update resource under the Specified action option, check CreateLoadBalancer and ModifyLoadBalancerType.

Resource: Select All resources.

Condition:

Condition key: Select alb:LoadBalancerType.

Operator: Select StringEquals.

Condition value: Type public.

Scenario 2: Allow an IAM user to query and update an ALB resource

If you need to grant an IAM user permission only to query and update all ALB resources, follow the example below to create a custom policy.

Visual editor

JSON editor

Statement:

Effect: Click Allow.

Service: Select alb.

Action: Under the Specified action option, check Update resource and Query resource.

Resource: Select All resources.

Scenario 3: Deny an IAM user from deleting an ALB resource

If you need to restrict an IAM user from deleting ALB resources, follow the example below to create a custom policy.

The effect specified in the following custom policy is Deny. A Deny policy must be used in conjunction with an Allow policy to take effect. When both Allow and Deny policies are granted to an IAM user, the Deny policy takes precedence.

If you want an IAM user to perform all actions of ALB resources except deleting ALB resources, grant the system default policy (ALBFullAccess) along with the custom policy below.

Visual editor

JSON editor

Statement:

Effect: Click Deny.

Service: Select alb.

Action: Under the Specified action option, check Delete resource.

Resource: Select All resources.

Scenario 4: Allow an IAM user to use tag features

If you need to grant an IAM user permission to use the tag features, follow the example below to create a custom policy.

If you want an IAM user to access all ALB resources and use tag features, grant the system default policy (ALBReadOnlyAccess) along with the custom policy below.

Visual editor

JSON editor

Statement:

Effect: Click Allow.

Service: Select alb.

Action: Under the Specified action option, check TagResources, UntagResources and ListTagsForResources.

Resource: Select All resources.