Question

A developer in a member account of an AWS Organization has an identity-based IAM policy that explicitly allows s3:GetObject on a specific bucket. The bucket's resource-based policy also allows the developer's role to read objects. However, a Service Control Policy (SCP) attached to the account's parent OU contains an explicit Deny for all S3 actions unless the request originates from a specific corporate IP range, using a Condition with aws:SourceIp. The developer attempts to download an object from a home network IP that is outside the corporate range. What is the result of this access attempt?

Accepted Answer

The request is denied because the SCP's explicit Deny applies before any Allow is evaluated and overrides all other policies.

Answer

The request is allowed because both the identity-based policy and the resource-based policy explicitly allow the action.

Answer

The request is allowed because SCPs only set the maximum permissions boundary and cannot deny specific requests at runtime.

Answer

The request is allowed because the resource-based policy grants access independently of SCPs and identity-based policies.