CLF-C02 Practice Question 93: Explicit Deny Evaluation
AWS Certified Cloud Practitioner (CLF-C02) · Test 10 · question 3 of 10
A developer's IAM user belongs to a group whose policy allows all Amazon S3 actions on every bucket in the account. A second policy, attached directly to the same user, explicitly denies s3:DeleteObject on a bucket named finance-records. The account is not part of AWS Organizations. What happens when the developer tries to delete an object in finance-records?
Show answer and explanation
Answer:
When AWS evaluates a request, it considers all the policies that apply. The permissions granted by identity-based policies (including those inherited from groups) and resource-based policies are combined. However, an explicit deny in any of these policies overrides the allow. The group's broad s3:* allow is overridden by the explicit deny for s3:DeleteObject on finance-records, so the deletion fails. The developer can still read or upload objects there, because nothing denies those actions.
Option A ignores the deny: an allow, however broad, never beats an explicit deny. Option B describes a priority rule that doesn't exist. Policies attached to a group and to a user are evaluated together, and neither source outranks the other; only explicit denies override allows. Option C is wrong because one explicit deny in any applicable policy is enough, so no second deny in a bucket policy is needed.
Reference: Policy evaluation logic