AWS IAM · Question 10 of 12
A user has one policy that allows s3:DeleteObject and a second one that explicitly denies the same action. What applies?
1 answer is correct. Medium Created with AI
Show answer
Answer
- D The explicit deny wins
Explanation
IAM evaluates all applicable policies together: without an allow everything is denied, an allow grants access, and an explicit deny overrides any allow. Order and time of attaching play no role.