Question

A company uses AWS Organizations with all features enabled. A developer's IAM user in a member account is attached to an identity-based policy that explicitly allows s3:GetObject on a specific bucket. The bucket's resource-based policy also allows the developer's principal to read objects. However, a Service Control Policy (SCP) attached to the developer's account contains an explicit Deny for all s3:* actions unless the request originates from a specific corporate IP range. The developer, working from home outside that range, receives an AccessDenied error. Which explanation correctly describes the policy evaluation outcome?

Accepted Answer

The SCP explicit deny takes precedence over any Allow in the identity-based or resource-based policies, so the request is denied regardless of the other Allows.

Answer

Because both the identity-based policy and the bucket policy explicitly allow the action, the union of Allows overrides the SCP, so the request should succeed.

Answer

SCPs only affect the root user and management account, so the developer's IAM user should not be blocked by the SCP.

Answer

The resource-based policy grants cross-account access that bypasses SCP evaluation, so the deny must originate from an incorrect bucket policy.