Complex Access COntrol

Question 1

IAM polices with resource level permissions

Answer 1

EC2: Create permissions for instances such as reboot, start, stop, or terminate based all the way down to the instances ID.
EBS Volumes: attach, Delete, Detach.
EC2 actions that are not one of these above are not governed by resource-level at this time.

Question 2

Additional security measures such as MFS authentication are also available when acting on certain resources

Answer 2

you can require MFS before an API request to delete an object within an S3 bucket.