How does AWS decide whether a request is allowed or denied when several IAM policies apply?
By default everything is denied. A request is allowed only if some policy explicitly allows it, and any explicit Deny in any applicable policy overrides every Allow.
Explain it simply
Think of a college gate. The default rule is that nobody enters. A permission slip (Allow) from the department lets you in. But if the principal has written a "this student is banned" order (explicit Deny), no permission slip matters.
Example
Order of evaluation
1. Is there an explicit Deny anywhere that matches? -> DENY
2. Otherwise, is there an explicit Allow? -> ALLOW
3. Otherwise -> DENY (implicit)
Example
Policy A (attached to user): Allow s3:* on arn:aws:s3:::reports/*
Policy B (attached to group): Deny s3:DeleteObject on arn:aws:s3:::reports/*
s3:GetObject -> allowed by A
s3:DeleteObject -> denied, because B has an explicit DenySeveral other layers can narrow permissions even when an identity policy allows: service control policies from AWS Organizations, permissions boundaries, session policies and resource policies. The final result must be allowed by every layer that applies.
Within one account, an identity policy Allow or a resource policy Allow can be enough. For cross-account access, both the identity and the resource must allow it.
What to say in the interview
"The default is implicit deny, an explicit Allow lets the request through, and an explicit Deny always wins. Permissions boundaries, SCPs and session policies can further restrict what an identity policy allows."
Common mistakes
- Believing an Allow in one policy can cancel a Deny in another.