Policy evaluation
Now that we've looked at all the policy types available to us within AWS, the question becomes, how do each of these policy types interact with each other, and is there some sort of order or operations in play among them for processing requests? Fortunately, there is an overall pattern of evaluation logic that we can follow to see how an action is evaluated. Unfortunately, there are plenty of exceptions and nuances – more than can be reasonably detailed here. Whereas it is still valuable to understand how requests are generally assessed by AWS IAM, it is always prudent to review the service-specific documentation for unique behaviors.
First, there are a few overarching rules:
- The AWS root account has full access by default.
- Requests from all other principals are denied by default.
- For identity-based policies and resource-based policies, an explicitly enumerated allow statement will override the default deny.
- Organizational service...
