Glossary
Also: Identity and Access Management
Access management in AWS: who or what may perform which action on which resource.
Permissions attach to identities, roles and policies. For applications, roles are the right way, because they work with short-lived credentials instead of distributing permanent keys.
Evaluation is restrictive: an explicit deny always wins, and without an explicit allow everything is denied.