Question

A developer's IAM user has an identity-based policy that allows s3:GetObject and s3:PutObject on all buckets. A permission boundary attached to the same user allows only s3:GetObject on the bucket arn:aws:s3:::reports-data and dynamodb:* on all tables. There are no applicable SCPs or resource-based policies. When the developer attempts s3:PutObject to arn:aws:s3:::reports-data, what is the result and why?

Accepted Answer

Denied, because an action must be allowed by BOTH the identity-based policy and the permission boundary, and the boundary does not permit s3:PutObject.

Answer

Allowed, because the identity-based policy explicitly grants s3:PutObject and permission boundaries only restrict, not grant, so the union is used.

Answer

Allowed, because the permission boundary grants dynamodb:* which broadens the effective permissions to include S3 writes.

Answer

Denied, because the permission boundary contains an explicit Deny for s3:PutObject that overrides the identity-based Allow.