An identity-based policy attached to a user contains an explicit Deny statement for s3:DeleteObject on all resources. A different policy attached to the same user grants s3:DeleteObject. What happens when the user attempts to delete an S3 object?
Show answer and explanation
Answer: B
During policy evaluation AWS gathers every applicable policy and resolves the request with a simple rule: an explicit Deny in any of them terminates evaluation immediately and the request is refused, no matter how many Allow statements exist elsewhere. Allow statements only accumulate permissions within the ceiling set by the Denys.
This 'explicit deny wins' behavior is what makes guardrail policies reliable — once a Deny is in place, no other grant can bypass it.
Why the other options are wrong
- A. Allow statements add up but never cancel a Deny in the same evaluation; there is no precedence ordering among policy types that would let this Allow overrule the explicit Deny.
- C. Evaluation examines the statements currently in effect, not policy creation timestamps; the result is identical regardless of which policy was attached earlier.
- D. Administrative privileges simply mean the user's own policies grant broad access — they are evaluated through the same logic, so the explicit Deny blocks the delete for admins too.