IAM & Identity

The guard that checks every single action, drawn as one flow with a fixed order of questions. It states the headline right: one explicit “no” beats any number of “yes”es. The flow it draws is correct for one account acting inside itself; this lesson is that guard’s rulebook written out properly, plus what changes the moment two accounts are involved.

Before you start. AWS Identity and Access Management (IAM) is the part of Amazon Web Services that decides who may do what, and it keeps two things apart: who you are and what you may do. Who you are is your login, the identity AWS knows you as once you’re signed in; this note calls that your badge. What you may do is written down in a policy, a list of allowed actions. You attach that list to one person, to a group of people, or to a role, a hat a program or a person puts on for a while and takes off again. Why So Many Boxes? - Identity vs Permission explains why AWS splits things this way, and The Badge Machine - IRSA end to end and OIDC - the Passport & the Stamp-Book how a badge gets handed out; you need none of them first. This note asks one narrower question: when several attached lists all have an opinion about the same request, which one wins.

The idea in 30 seconds

Every single AWS action, not just logging in, is checked against the same one rulebook, fresh, every time.
Explicit deny wins over everything. One no, from any source, ends the request immediately; no number of yeses anywhere else changes that.
Falling through the rulebook with nobody saying yes is still a no - implicit deny, the default. It’s a different bug from an explicit one: nobody granted it, versus somebody blocked it.
Inside one account, either the badge’s own policy or the door’s own policy - a resource-based policy - can supply the yes.
A guardrail, an org-wide or session-wide ceiling, can only take permission away. It never becomes the yes itself.
Least privilege is what keeps one stolen credential from reaching everything: give it only the power its job needs, so a breach in one place doesn’t take the backups with it.

Read the story · Skip to the numbers