Using the Access Policy Language - Amazon Simple Notification Service
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Using the Access Policy Language

The following figure and table describe the general process of how access control works with the access policy language.

Basic flow for access control with the access policy language


You write a policy for your resource.

For example, you write a policy to specify permissions for your Amazon SNS topics.


You upload your policy to Amazon.

The Amazon service itself provides an API you use to upload your policies. For example, you use the Amazon SNS SetTopicAttributes action to upload a policy for a particular Amazon SNS topic.


Someone sends a request to use your resource.

For example, a user sends a request to Amazon SNS to use one of your topics.


The Amazon service determines which policies are applicable to the request.

For example, Amazon SNS looks at all the available Amazon SNS policies and determines which ones are applicable (based on what the resource is, who the requester is, etc.).


The Amazon service evaluates the policies.

For example, Amazon SNS evaluates the policies and determines if the requester is allowed to use your topic or not. For information about the decision logic, see Evaluation logic.


The Amazon service either denies the request or continues to process it.

For example, based on the policy evaluation result, the service either returns an "Access denied" error to the requester or continues to process the request.