Policy evaluation logic

Exam tasks: 4.2 (Skills 4.2.1 authorization controls and resource policies for cross-account access, 4.2.3 interpret and implement least-privilege policies, 4.2.4 analyze authorization failures)

The decision: given every policy that touches this request, is there an explicit deny, and if not, does each layer that must allow it actually allow it?

Policy typesCopy Anchor Link

Every request starts as an implicit deny. It needs at least one allow, and no explicit deny, in each layer that applies.

The evaluation flowCopy Anchor Link

• Explicit deny is checked across everything first. A deny in an SCP, RCP, bucket policy, boundary or session policy ends it. No allow anywhere can override it.
• Guardrails need an allow too. SCPs and RCPs start with the AWS managed FullAWSAccess and RCPFullAWSAccess policies. If you detach FullAWSAccess without adding your own allows, member accounts can do nothing. RCPFullAWSAccess can't be detached.
• The same-account shortcut. If a bucket policy (or another resource policy) in the same account grants access directly to the user ARN or role session ARN, an implicit deny from the identity policy, boundary or session policy doesn't stop it. If it grants to the role ARN, the boundary and session policy still limit it.
• Role trust policies and KMS key policies are exceptions. They must allow the principal explicitly, even in the same account. An identity policy with kms:* does nothing if the key policy doesn't delegate to IAM.

Same account vs cross-accountCopy Anchor Link

• Services without resource policies (most of EC2, for example) can only be reached cross-account by assuming a role in the owning account.
• With a resource policy, the caller keeps its own identity, so CloudTrail in the resource account records the external principal, and the caller doesn't give up its own permissions.

Condition keys that decide exam questionsCopy Anchor Link

Operators and multi-value logicCopy Anchor Link

• Within a condition key, values are OR. Across keys and across operators, it's AND.
• StringEquals vs StringLike: only Like honours * and ?. The same goes for ArnEquals vs ArnLike.
• IpAddress / NotIpAddress take CIDRs. Bool takes "true" or "false" as strings.
• ...IfExists makes the condition match when the key is absent. Null tests whether a key is present at all.
• ForAnyValue: and ForAllValues: are for multi-valued keys such as aws:TagKeys. ForAllValues returns true when the key is missing, so pair it with a Null check if absence must fail.

The MFA deny done rightCopy Anchor Link

Long-term access keys never carry aws:MultiFactorAuthPresent. A deny with Bool false misses them, because the key is absent. BoolIfExists catches both cases:

{
  "Sid": "DenyDeletesWithoutMfa",
  "Effect": "Deny",
  "Action": ["s3:DeleteObject", "s3:DeleteBucket"],
  "Resource": "*",
  "Condition": { "BoolIfExists": { "aws:MultiFactorAuthPresent": "false" } }
}

A network perimeter on a bucketCopy Anchor Link

{
  "Sid": "OnlyFromOurEndpointOrServices",
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:*",
  "Resource": ["arn:aws:s3:::lumen-ledger", "arn:aws:s3:::lumen-ledger/*"],
  "Condition": {
    "StringNotEqualsIfExists": { "aws:SourceVpce": "vpce-0a1b2c3d4e5f60718" },
    "BoolIfExists": { "aws:PrincipalIsAWSService": "false" }
  }
}

Both conditions must be true for the deny to apply: the request didn't come through the endpoint and it isn't an AWS service principal (such as CloudTrail delivering logs).

NotAction, NotResource and NotPrincipalCopy Anchor Link

• Allow + NotAction grants every action except those listed, including services launched next year. It's almost never least privilege.
• Deny + NotAction with a condition is the useful form: "deny everything except IAM and STS unless MFA is present", or "deny everything outside eu-west-1 except global services".
• NotResource in an allow means "every resource except these". Same risk as above.
• NotPrincipal with Deny is fragile: you must list the role and the assumed-role session ARN and the account, or you lock out the principal you meant to exempt. Prefer "Principal": "*" with an aws:PrincipalArn condition (ArnNotLike), which matches every session of the role.

ScenariosCopy Anchor Link

Further readingCopy Anchor Link

• Policy evaluation logic
• Cross-account policy evaluation logic
• AWS global condition context keys
• IAM JSON policy elements: condition operators