Many Security Specialty questions come down to one skill: working out why a request is allowed or denied. This page collects the evaluation rules AWS documents for identity-based policies, resource-based policies, permissions boundaries and organization policies (SCPs and RCPs).
| Combination | Effective permissions |
|---|---|
| Identity-based + resource-based policy (same account) | Union: allowed if either allows. An explicit Deny in either overrides the Allow. |
| Identity-based policy + permissions boundary | Intersection: both must allow. An explicit Deny in either overrides the Allow. |
| Identity-based policy + SCPs + RCPs (no resource-based policy) | Intersection: the action must be allowed by all three. An explicit Deny in any of them overrides the Allow. |
| Identity-based policy + permissions boundary + SCP | All three must allow the action. |
Source: docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html
An explicit Deny always overrides any Allow. Within the same account, effective permissions are the union of the identity-based and resource-based policies: it is enough that one allows, unless one of them explicitly denies.
Official source: docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html
A permissions boundary never grants permissions: effective permissions are the INTERSECTION of the identity-based policy and the boundary. Adding a boundary to a user can reduce what they can do; removing it can increase it.
Official source: docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html
In a member account with no resource-based policy, an action must be allowed by the identity-based policy, the SCPs and the RCPs at the same time. An explicit Deny in any of the three overrides the Allow.
Official source: docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html
An SCP never grants permissions: it sets the maximum available. Even with an SCP that allows everything, a user with no IAM policy has no access. Effective permissions are the intersection of SCPs/RCPs and IAM policies.
Official source: docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html
SCPs do not affect the management account or service-linked roles. They do affect member accounts, including their root user and delegated administrators.
Official source: docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html
SCPs only affect users and roles managed by accounts in the organization. If a bucket in your organization grants access through a bucket policy to account B (outside the organization), the SCP does not apply to those external users.
Official source: docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html
Do not remove the FullAWSAccess policy without replacing it with one that allows actions: otherwise every action in member accounts fails. AWS recommends testing on an OU, not on the organization root.
Official source: docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html
If you disable the SCP policy type in a root, all SCPs are detached, and when you re-enable it only FullAWSAccess remains. Previous attachments are lost and must be reattached manually.
Official source: docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html
Use IAM 'service last accessed data' (or CloudTrail) to see which services allowed by an SCP are never used and refine the SCP toward least privilege. If a permissions boundary and an SCP both exist, both must allow the action.
Official source: docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html
Answer practice questions, then review your mistakes with spaced repetition.