Question

A SysOps administrator attaches an IAM policy to a group that explicitly allows all Amazon S3 actions on a company data bucket. A separate managed policy attached to one user in that group includes an explicit deny for s3:DeleteObject on the same bucket. When that user attempts to delete an object from the bucket, the action fails. What is the reason for this behavior?

Accepted Answer

An explicit deny in any applicable IAM policy always overrides an explicit allow, so the delete is denied.

Answer

Group policies always take precedence over policies attached directly to a user, so the group allow should have applied.

Answer

IAM evaluates the most recently attached policy last, so the deny only applies because it was added after the allow.

Answer

The delete failed because S3 bucket policies must also explicitly allow the action regardless of IAM permissions.