The Policy Evaluation Decision Flow
Follow how explicit denies, allows, and defaults are resolved.
How AWS Decides
When any request reaches AWS, the IAM engine runs a precise evaluation flow to decide Allow or Deny. Memorizing this order is one of the highest-value things you can do for the SCS-C02 exam, because tricky scenario questions hinge on which policy type wins when several are in play.
Deny by Default
The starting point is always an implicit deny. If nothing in the evaluation grants access, the request is denied. This deny-by-default stance means you must explicitly Allow an action somewhere for it to succeed; silence equals denial.
All lessons in this course
- Anatomy of an IAM Policy Document
- Identity-Based versus Resource-Based Policies
- The Policy Evaluation Decision Flow
- Conditions, Wildcards, and Policy Variables