How AWS decides: explicit deny beats everything

Build a request, switch policies on and off, read the decision. Every step says why — including the case where a statement matches the action and the resource but its Condition does not, so the Allow silently never applies.

—

The request

The policies

1 · Identity policy, on the caller
2 · Resource policy, on the bucket

How the decision was made

The rule, in order

  1. An explicit Deny that matches → DENY. Final.
  2. Else no Allow matches → implicit DENY.
  3. Else → ALLOW.

The walkthrough shows four steps against these three rules. The extra one is the permissions boundary, checked between rules 1 and 2 because it decides which Allows still count. It is a ceiling on what the identity policy grants — never a grant of its own, and it holds no Deny: being outside it is enough.

Two deliberate simplifications, so you do not learn them wrong: the SCP here is modelled Deny-only (a real SCP must also carry an Allow, or everything under it is denied), and the permissions boundary caps only what the identity policy grants — a same-account bucket policy is not capped by it.