Policy evaluation logic in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

How does AWS evaluate conflicting policies?

In AWS, when a user has multiple policies attached that conflict, what is the final decision for an action?

A Explicit deny always overrides any allow, so the action is denied.

B Allow always overrides deny, so the action is allowed.

C The last policy attached to the user determines the decision.

D AWS randomly picks allow or deny if policies conflict.

💡 Hint

Think about what happens if one policy says no and another says yes.

AWS policy evaluation logic states that explicit deny always overrides any allow. So if any policy explicitly denies an action, the action is denied regardless of other allows.

❓ service_behavior

intermediate

What happens if no policy explicitly allows an action?

If a user tries to perform an action but none of their policies explicitly allow it, what is the result?

A The action is allowed by default.

B The action is allowed only if the user is an administrator.

C The action is allowed if the resource policy allows it.

D The action is denied by default.

💡 Hint

Think about the default stance of AWS when no explicit permission is given.

AWS denies all actions by default unless explicitly allowed by a policy.

❓ Configuration

advanced

Identify the effect of this IAM policy snippet

Given this IAM policy snippet, what is the effect on the s3:DeleteObject action?

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:DeleteObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    },
    {
      "Effect": "Deny",
      "Action": "s3:DeleteObject",
      "Resource": "arn:aws:s3:::example-bucket/private/*"
    }
  ]
}

A Users cannot delete any objects in the bucket.

B Users can delete objects except those in the private folder.

C Users can delete any object in the bucket including private folder objects.

D Users can only delete objects in the private folder.

💡 Hint

Consider how explicit deny affects specific resource paths.

The policy allows deleting objects in the whole bucket but explicitly denies deleting objects in the private folder. The explicit deny overrides the allow for that path.

❓ security

advanced

What is the impact of a missing Action field in an IAM policy statement?

Consider this IAM policy statement missing the Action field:

{
  "Effect": "Allow",
  "Resource": "*"
}

What will happen when this policy is evaluated?

A The policy allows all actions on all resources.

B The policy allows no actions because <code>Action</code> is required.

C The policy is invalid and will cause an error when attached.

D The policy denies all actions because <code>Action</code> is missing.

💡 Hint

Think about required fields in IAM policy statements.

The Action field is required in IAM policy statements. Missing it makes the policy invalid and AWS rejects it.

❓ Architecture

expert

Order the steps AWS uses to evaluate a request with multiple policies

Arrange the following steps in the correct order AWS evaluates an IAM request with multiple policies:

A 1,4,2,3

B 4,1,2,3

C 2,1,4,3

D 1,2,4,3

💡 Hint

Remember explicit deny overrides all, and resource policies are checked after user policies.

AWS first checks for explicit deny in any policy, then evaluates resource-based policies if applicable, then checks for explicit allow, and finally denies by default if no allow found.