An AWS IAM user has two identity-based policies attached to their identity. The first policy explicitly allows the 's3:GetObject' action on all Amazon S3 resources, while the second policy explicitly denies the 's3:GetObject' action on a specific S3 bucket named 'financial-records'. Which of the following describes the final access decision when the user attempts to retrieve an object from the 'financial-records' bucket?
- AAccess is allowed because the explicit deny policy only applies when the user accesses the bucket through an assumed IAM role, not as an individual IAM user.
- BAccess is allowed because explicit deny policies only restrict the AWS account root user, whereas IAM users are governed only by allow policies.
- Access is denied because an explicit deny in any applicable policy always overrides an explicit allow.Answer
- DAccess is allowed because AWS is responsible for infrastructure-level data protection, meaning customer-defined deny policies do not override default access configurations.
Answer
Access is denied because an explicit deny in any applicable policy always overrides an explicit allow.
The correct answer is that access is denied because in AWS IAM policy evaluation, an explicit deny always overrides any explicit allows. Even though the first policy grants read access to all S3 buckets, the second policy's explicit deny on the specific bucket ensures that any request to retrieve objects from that bucket is blocked.
Step-by-Step Solution
Key Concept
AWS IAM Policy Evaluation Logic (Explicit Deny Override)