World map

 

BM

World A2: Keys & Guards

How AWS decides: deny wins

You will learn: the three rules AWS uses to say yes or no, and why a Deny always wins.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

Aina has a key that allows saving the menu. Another policy says no over plain, unencrypted connections. Her upload uses one. Predict.

Read the request and its policies. Will AWS say Allow or Deny?

The request

Who
Aina (IAM user)arn:aws:iam::111122223333:user/aina
Wants to
s3:PutObject
On
arn:aws:s3:::kedai-menu/today.json
Request facts
aws:SecureTransport = false
Identity policy (key ring) · menu-writer
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::kedai-menu/*"
}
]
}
Identity policy (key ring) · tls-only
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": "s3:*",
"Resource": "*",
"Condition": { "Bool": { "aws:SecureTransport": "false" } }
}
]
}
Your guess:

Watch

AWS follows three rules. A written Deny that fits always wins: an explicit deny: A written Deny that fits the request. It beats every Allow, always.. Else, an Allow that fits wins. Else, the answer is no. Sort the cases.

Drag a card into a box. Or tap the card, then tap the box.

      Try it

      Aina tries to delete the menu file. Her only policy allows saving. Predict.

      Read the request and its policies. Will AWS say Allow or Deny?

      The request

      Who
      Aina (IAM user)arn:aws:iam::111122223333:user/aina
      Wants to
      s3:DeleteObject
      On
      arn:aws:s3:::kedai-menu/today.json
      Identity policy (key ring) · menu-writer
      {
      "Version": "2012-10-17",
      "Statement": [
      {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::kedai-menu/*"
      }
      ]
      }
      Your guess:

      Predict

      A teammate adds a policy with fifty Allows for Aina. One old policy still has a Deny that fits. What wins?

      Check

      The no-deletes policy was meant to stop deletes only. It blocks everything. Fix its pink line so Aina can save again.

      Change the pink line so AWS says Allow.

      The request

      Who
      Aina (IAM user)arn:aws:iam::111122223333:user/aina
      Wants to
      s3:PutObject
      On
      arn:aws:s3:::kedai-menu/today.json
      Identity policy (key ring) · menu-writer
      {
      "Version": "2012-10-17",
      "Statement": [
      {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::kedai-menu/*"
      }
      ]
      }
      Identity policy (key ring) · no-deletes
      {
      "Version": "2012-10-17",
      "Statement": [
      {
      "Effect": "Deny",
      "Resource": "*"
      }
      ]
      }

      You did it!

      You can now predict AWS’s answer: Deny first, then Allow, else no.

      Go deeper (optional)

      The full check also looks at fences: SCPs, resource policies and permissions boundaries. Lesson 8 shows them. A Deny anywhere still wins.

      Real rep (free): in the IAM console, open the policy simulator. Pick your user, an action, and see Allow or Deny before you change anything.