A developer is reasoning about how AWS evaluates a single same-account API request against an IAM identity-based policy on the calling role and a resource-based policy on the target resource. Which TWO statements correctly describe AWS IAM policy evaluation logic for that request? (Select TWO.)
- AAn explicit Deny in either the identity-based policy or the resource-based policy overrides any Allow and denies the request. Correct
- BWithin the same account, an Allow in the resource-based policy alone is sufficient even if no identity-based policy allows the action. Correct
- CIf neither policy contains a matching Allow or Deny, the request is permitted because the account owns both the principal and the resource.
- DThe identity-based policy Allow is ignored whenever a resource-based policy is present, which always takes precedence.
- EA resource-based policy can only narrow permissions granted by an identity-based policy, never grant new access on its own.
Why A is correct: Correct: an explicit Deny in any applicable policy always wins over every Allow, so a Deny in either policy blocks the request.
Why B is correct: Correct: for same-account access an Allow in either the identity-based or the resource-based policy grants the action, so a resource-based Allow alone suffices.
Why C is wrong: Tempting because the account owns both, but the default is an implicit deny, so absence of any Allow means the request is denied.
Why D is wrong: Sounds like resource policies dominate, but both policy types are evaluated together; neither blanket-overrides the other except via explicit Deny.
Why E is wrong: This describes a permissions boundary, not a resource-based policy, which can independently grant same-account access by itself.