thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Cloud Computing · Advanced

IAM Policy Evaluation Logic

Rules AWS uses to decide a request: explicit deny wins, then an allow is required from all applicable policy types; otherwise implicit deny.

Definition

AWS evaluates all applicable policies: any explicit deny results in denial; SCPs, RCPs, permissions boundaries and session policies must allow the action if present; and an identity-based or resource-based policy must explicitly allow it. Requests without an applicable allow are implicitly denied.

Example

A user with AdministratorAccess cannot delete CloudTrail trails because an SCP explicitly denies cloudtrail:DeleteTrail.

Exam tip

Remember the order: explicit deny overrides everything; SCPs limit even account administrators but never grant permissions.

Related terms