Authorization

• Every request is implicitly denied until a policy allows it
• An explicit deny overrides every allow, anywhere in the request
• Policy types evaluate in a fixed order: deny, RCP, SCP, resource, identity, boundary, session
• Identity-based and resource-based policies form a union of grants
• A permission boundary caps permissions, it never grants them
• A session policy further caps a single assumed-role or federated session
• SCPs cap principals and RCPs cap resources, but neither grants
• Cross-account access requires an allow on both the trusted and trusting account
• A role can only be assumed if its trust policy names the principal
• ABAC authorizes on tags so permissions scale without new policies
• RBAC fits stable job functions but needs policy edits as resources grow
• Session tags carry corporate attributes into ABAC for federated users
• Verified Permissions authorizes inside your app, IAM authorizes AWS
• IAM Roles Anywhere gives external workloads temp credentials via X.509
• Access Analyzer external-access findings reveal resources shared outside the org
• Access Analyzer unused-access findings drive least-privilege cleanup
• Custom policy checks block deployments that grant new or critical access
• The IAM Policy Simulator tests effective access without making the real call
• IAM paths namespace entities so policies can target groups of roles
• Apply least privilege by starting minimal and capping with boundaries
• A resource-based allow can grant access despite an implicit identity deny
• sts:ExternalId in a role trust policy defeats the confused-deputy problem for third-party access
• aws:PrincipalOrgID confines access to your organization even if an account ID is wrong
• SCPs never restrict the management account or service-linked roles
• Effective SCP permission is the intersection down the OU path, and any deny in the chain wins
• Carve a break-glass role out of an SCP deny with a PrincipalARN StringNotLike condition
• Block Public Access takes the most restrictive of org, account, and bucket settings
• S3 'Bucket owner enforced' disables ACLs so the owner owns every object
• Passing an IAM role to a service requires iam:PassRole on the caller
• The iam:PermissionsBoundary condition forces a boundary onto every role developers create

Unlock with Premium — includes all practice exams and the complete study guide.