Question

A developer is assigned an IAM identity policy that grants full access to Amazon S3 and Amazon DynamoDB (s3:* and dynamodb:*). The same IAM user also has a permission boundary attached that allows only s3:GetObject and s3:PutObject. There are no applicable SCPs or resource-based policies. When the developer attempts to call dynamodb:PutItem and s3:DeleteObject, what is the outcome?

Accepted Answer

Both dynamodb:PutItem and s3:DeleteObject are denied because the permission boundary does not allow either action.

Answer

Both dynamodb:PutItem and s3:DeleteObject are allowed because the identity policy grants full access.

Answer

dynamodb:PutItem is allowed, but s3:DeleteObject is denied by the permission boundary.

Answer

s3:DeleteObject is allowed, but dynamodb:PutItem is denied by the permission boundary.