Interview Q&A / AWS & Cloud

1. How does AWS decide whether a request is allowed or denied when several IAM policies apply?

   By default everything is denied. A request is allowed only if some policy explicitly allows it, and any explicit Deny in any applicable policy overrides every Allow.

   IntermediateQuick answer1 min read
2. How would you give a user read-only access to one specific S3 bucket?

   Attach an identity policy that allows s3:ListBucket on the bucket ARN and s3:GetObject on the objects inside it using the bucket ARN with /*. Nothing else is allowed, so the user can read but not write or delete.

   IntermediateQuick answer1 min read