The Two Planes - why AWS feels like 100 random things

The Two Planes - Permission vs Network · Open board

The two guards on the poster, and every scary AWS word this lesson touches, filed under whichever one it answers to.

Before you start. You need to know what a pod is: one running copy of your program, given its own address on the network. And what an API call is: one program asking another, over that network, to do something on its behalf - read a file, start a job.

The idea in 30 seconds

AWS’s confusing pile of names sorts into two planes: NETWORK asks can the packet reach, PERMISSION asks is the identity allowed.
A security group only checks addresses and ports; a role’s policy only checks who’s asking and what they asked for. Neither reads the other.
Every request passes both guards, always in that order: a packet has to arrive before anyone can ask who sent it.
The two guards fail in different shapes: network fails by silence, a timeout; permission fails by answering, AccessDenied.
A role is a badge anyone who qualifies can put on; a policy is the checklist stapled to it saying what it opens.
The rulebooks differ in size for the same reason they’re different guards: a security group is checked per packet, capped in addresses; a policy is read per call, capped in characters.

Read the story · Skip to the numbers