Can I do that with policy? Understanding the AWS Service Authorization Reference

This blog post explains how to use the AWS Service Authorization Reference to determine what information is available in the authorization context and therefore what AWS IAM policies can enforce. It provides examples (S3 server-side encryption, EC2 instance and network restrictions, DynamoDB fine-grained access) and highlights scenarios—such as restricting security group CIDR rules or Lambda memory size—where IAM cannot enforce the desired control, recommending detective or automated responses (AWS Config, EventBridge, Lambda) and a layered security approach.