An IAM user has two conflicting policies as part of two separate groups. One policy allows him to access an S3 bucket, while another policy denies him the access. Can the user access that bucket?
A) Yes, always
B) No
C) Yes, provided he accesses with the group which has S3 access
D) Yes, but just read only access of the bucket

Question

Quizplus · Accepted Answer

In AWS IAM, if there are conflicting policies, the explicit deny always takes precedence over any allow. Therefore, the user will not be able to access the S3 bucket.

An IAM User Has Two Conflicting Policies as Part of Two