Security World 1 · Who Can Do What · Stage 1

Deny Wins

The adjusters hold an Allow and are refused on every claim file. Find the statement that decides.

Domain: Security
World: Security World 1: Who Can Do What (Associate)
Game type: Policy stepper: Edit identity, resource and key policies; the matrix shows the gate that decided.
Time: About 15 minutes on a first attempt (estimated)
Articles: How AWS decides a request: why an explicit deny always wins
Identity policy or bucket policy: which one has to allow?
Exam guides: SAA-C03Task 1.1: Design secure access to AWS resources
SOA-C03Skill 4.1.1: Implement IAM features (for example, password policies, multi-factor authentication [MFA], roles, federated identity, resource policies, policy conditions)
DEA-C01Skill 4.2.1: Create custom IAM policies when a managed policy does not meet the needs
SCS-C03Skill 4.2.3: Design, interpret, and implement IAM policies by following the principle of least privilege (for example, permission boundaries, session policies); Skill 4.2.4: Analyze authorization failures to determine causes or effects (for example, IAM Policy Simulator, IAM Access Analyzer)