Policy statement

Also written: Statement, Effect, Action, Resource

One rule inside an AWS policy: its Effect (Allow or Deny), the Actions it covers (such as s3:GetObject) and the Resources it applies to. Writing one narrow statement per job keeps a role to least privilege.