[Solved] A user has a policy allowing lambda:InvokeFunction on all functions, but a resource-based policy on a specific Lambda... What is the final effect when the user tries to invoke that function? | AWS

AWS - Identity and Access Management

A user has a policy allowing lambda:InvokeFunction on all functions, but a resource-based policy on a specific Lambda function denies lambda:InvokeFunction for that user. What is the final effect when the user tries to invoke that function?

AThe invocation is denied due to resource-based policy deny

BThe invocation is allowed because user policy allows it

CThe invocation is allowed only if the user is in the same account

DThe invocation is denied unless the user has admin privileges

Step-by-Step Solution

Solution:

Step 1: Understand policy types
User policy allows, but resource-based policy explicitly denies.
Step 2: Apply evaluation precedence
Explicit Deny in resource-based policy overrides user Allow.
Final Answer:
Invocation is denied due to explicit deny -> Option A
Quick Check:
Resource Deny overrides user Allow [OK]

Quick Trick: Resource policy Deny beats user policy Allow [OK]

Common Mistakes:

Assuming user policy always wins
Ignoring resource-based policy effect
Thinking account ownership affects deny

Master "Identity and Access Management" in AWS

9 interactive learning modes - each teaches the same concept differently

Learn Why Deep Visual Try Challenge Project Recall Time

More AWS Quizzes

What is the final effect when the user tries to invoke that function?

Step 1: Understand policy types

Step 2: Apply evaluation precedence

Final Answer:

Quick Check:

Want More Practice?