A brand-new IAM user is created but no policies are attached to it. What can this user do in AWS?
Show answer and explanation
Answer: C
IAM evaluates everything from a starting position of implicit deny: with no policy granting anything, every request the user makes is rejected, across every service and every Region. Access exists only after some policy adds an explicit Allow, which preserves least privilege — new identities are harmless by default rather than broadly capable.
Why the other options are wrong
- A. No policy means no Allow statements, and there is no default baseline providing read access to anything.
- B. Regional scope does not substitute for granted permissions; without any Allow the user is blocked everywhere.
- D. Even IAM and billing actions require an explicit Allow — nothing is granted automatically to a bare new user.