IAM: an explicit deny you cannot find.

Identity policies, resource policies, permission boundaries, SCPs, session policies and ACLs, evaluated together, with an implicit deny underneath and an explicit deny that beats everything. The policy simulator disagrees with production. The error says access denied and names nothing. Complexity is a security problem in its own right: a permission model nobody can reason about produces wide-open policies written by exhausted people.

Post your story