Question

A company uses AWS Organizations with an OU named 'Workloads'. An SCP attached to that OU allows only the ec2:* and s3:* actions. A developer in a member account has an IAM identity-based policy that grants dynamodb:PutItem and s3:GetObject. The developer also has a permissions boundary attached that allows only s3:* actions. When the developer attempts to call dynamodb:PutItem, the request is denied. What is the primary reason for the denial?

Accepted Answer

The SCP does not include dynamodb:PutItem, so the action is not permitted at the organization level regardless of the identity-based policy.

Answer

The permissions boundary explicitly denies dynamodb:PutItem, overriding the SCP allow.

Answer

The identity-based policy grant for dynamodb:PutItem is invalid because it conflicts with the s3:GetObject grant.

Answer

STS automatically strips DynamoDB permissions from federated developer sessions unless a session policy re-adds them.