Question

A security engineer is reviewing a customer-managed IAM policy attached to a developer group. The policy contains a single statement with "Effect": "Allow", "NotAction": ["iam:*", "organizations:*"], and "Resource": "*". Developers report they can perform far more actions than intended, including deleting production S3 buckets and modifying KMS keys. What is the most accurate explanation of this behavior?

Accepted Answer

The NotAction element with Allow grants permission to every AWS action except those in the list, so developers are effectively allowed all non-IAM, non-Organizations actions on all resources.

Answer

NotAction only functions inside Deny statements, so this policy grants nothing and the developers' access must come from another attached policy.

Answer

NotAction with Allow implicitly denies the listed actions, but grants only S3 and KMS actions because those are the services the developers are using.

Answer

The Resource "*" combined with NotAction restricts the policy to read-only actions across all services, so bucket deletion should not be possible.