How does AWS decide whether an IAM request is allowed? Explain the evaluation logic.
What they are really testing: Whether you know the default-deny model and that an explicit deny always wins, plus identity vs resource policies. Getting this wrong causes both lockouts and over-permissioning.
A real interview question
How does AWS decide whether an IAM request is allowed? Explain the evaluation logic.
What most people say
drag me
“IAM checks the policies attached to the user and allows the action if there is a policy that allows it.”
It misses default deny, that explicit deny overrides any allow, and resource policies / SCPs / boundaries. That incomplete model is exactly how people create both accidental lockouts and over-broad access.
The follow-ups they ask next
A user has an IAM policy allowing s3:GetObject but still gets AccessDenied. What could cause it?
An explicit deny somewhere (a bucket policy, an SCP, or a permission boundary) overrides the allow. Also check the bucket policy/KMS key policy for cross-account or encryption requirements.
Do SCPs grant permissions?
No. SCPs only set the maximum allowable permissions for accounts in an org. You still need an identity-based allow; the SCP just cannot expand beyond its limit.
What the interviewer is listening for
- States default deny + explicit-deny-wins
- Knows identity vs resource policies
- Knows SCPs/boundaries cap, not grant
What sinks the answer
- Only "allow if a policy allows"
- Unaware explicit deny overrides allow
- Thinks SCPs grant access
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Start from [implicit default deny]. [Any explicit deny wins, no allow overrides it]. With no deny, AWS looks for [an explicit allow across identity and resource policies], else the deny stands. [SCPs and permission boundaries are ceilings, not grants]: an action must be [allowed by the policy AND within the SCP/boundary].”
Keep going with aws
Foundation
What are the EC2 purchasing options (On-Demand, Reserved, Savings Plans, Spot), and how do you mix them?
Foundation
Walk me through the main S3 storage classes and how you would use lifecycle policies to control cost.
Junior
How does an EC2 Auto Scaling Group work, and how would you configure it to scale on load?
Mid
How do you choose between SQS, SNS, EventBridge, and Kinesis?
Mid
What are VPC endpoints, and when would you use a gateway endpoint versus an interface endpoint?
Mid
How does CloudFront work, and how would you use it to serve a web app efficiently and securely?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free