Study. uk . com
  1. Home
  2. All questions
  3. Question 4

AWS Certified Solutions Architect study material · question 4 of 500

A request is allowed by an identity-based policy but explicitly denied by a service control policy. What is the outcome?

  1. The request is denied
  2. The request is allowed, because SCPs cannot deny
  3. The request is allowed if the principal is an administrator
  4. The outcome depends on which policy was attached first
Show the answer

Answer: A. The request is denied

An explicit deny in any applicable policy overrides every allow, wherever that allow came from.

Source: Policy evaluation logic (Amazon Web Services) — Evaluating identity-based policies with AWS Organizations SCPs or RCPs

Challenge yourself on this topic → Study as cards