With most services, control of the resource is governed directly through IAM. As we have learned, some services have resource policies and, with SNS, the resource policy will be the place where we will control access on a per-topic basis. While we have the ability in IAM to control access to the SNS service, once a user, role, or group is allowed access, the IAM policy applies globally to all topics. On top of that, for each topic separately, we have the ability to allow access to either an IAM security principal or an anonymous user (everyone). For each topic, we have the ability to edit the default Access Policy and thus control access to the topic.