AWS - Identity and Access Management
An IAM policy grants full access to S3 but denies DeleteObject on a specific bucket. Why does this violate least privilege?
An IAM policy grants full access to S3 but denies DeleteObject on a specific bucket. Why does this violate least privilege?
medium📝 Debug Q6 of 15
Step-by-Step Solution
Solution:
Step 1: Understand policy effect
Full access grants all actions; deny restricts one action on one bucket.Step 2: Analyze least privilege violation
Granting full access is too broad; deny does not fix over-permission.Final Answer:
Granting full access is too broad even with deny -> Option BQuick Check:
Least privilege forbids broad allow with exceptions [OK]
Quick Trick: Avoid broad allow; use specific allows instead [OK]
Common Mistakes:
- Thinking deny overrides all allow
- Assuming deny statements are ignored
- Believing DeleteObject is invalid
Master "Identity and Access Management" in AWS
Want More Practice?
15+ quiz questions · All difficulty levels · Free
Free Signup - Practice All QuestionsMore AWS Quizzes