Question

Difficulty: MediumIdentity and Access Management (IAM)

An AWS IAM user has two identity-based policies attached to their identity. The first policy explicitly allows the 's3:GetObject' action on all Amazon S3 resources, while the second policy explicitly denies the 's3:GetObject' action on a specific S3 bucket named 'financial-records'. Which of the following describes the final access decision when the user attempts to retrieve an object from the 'financial-records' bucket?

  1. A
    Access is allowed because the explicit deny policy only applies when the user accesses the bucket through an assumed IAM role, not as an individual IAM user.
  2. B
    Access is allowed because explicit deny policies only restrict the AWS account root user, whereas IAM users are governed only by allow policies.
  3. Access is denied because an explicit deny in any applicable policy always overrides an explicit allow.Answer
  4. D
    Access is allowed because AWS is responsible for infrastructure-level data protection, meaning customer-defined deny policies do not override default access configurations.

Answer

Access is denied because an explicit deny in any applicable policy always overrides an explicit allow.
The correct answer is that access is denied because in AWS IAM policy evaluation, an explicit deny always overrides any explicit allows. Even though the first policy grants read access to all S3 buckets, the second policy's explicit deny on the specific bucket ensures that any request to retrieve objects from that bucket is blocked.

Step-by-Step Solution

1
Analyze the attached IAM policies to identify all applicable statements.
There is one policy statement that explicitly allows the action on all S3 resources, and another statement that explicitly denies the action on the 'financial-records' bucket.
AWS evaluates all policies attached to the user identity simultaneously to determine permissions.
2
Apply the AWS IAM policy evaluation hierarchy.
The explicit deny on the specific bucket takes precedence over the general explicit allow.
By default, all requests are denied in AWS. An explicit allow overrides the default deny, but any explicit deny always overrides any explicit allows.

Key Concept

AWS IAM Policy Evaluation Logic (Explicit Deny Override)
Rate this question