SAA-C03 - Design Secure Architectures - Section 1.1

Design a flexible authorisation model using IAM users, groups, roles and policies to grant least-privilege access to AWS resources.

Describe IAM users, groups, roles, and policies, and explain how policy evaluation logic combines identity-based and resource-based policies to produce an allow or deny decision. Apply least-privilege principles by choosing between managed and inline policies and scoping permissions to only the resources and actions a principal requires.

IAM policiesIAM rolesLeast privilegePolicy evaluation

Practice question for this objective

Free sampleDesign Secure Architecturesmedium

An architect is reasoning about how IAM decides whether a single API request is allowed when the calling principal is subject to an identity-based policy, a resource-based policy, and a permissions boundary. To predict the outcome correctly, which TWO statements about IAM policy evaluation are true? Select TWO.

  • AAn explicit Deny in any applicable policy overrides any Allow, so the request is denied regardless of how many policies allow it. Correct
  • BAn Allow in the identity-based policy overrides an explicit Deny in the resource-based policy when both target the same action.
  • CIf no policy explicitly allows the action, the request is denied by default through an implicit deny. Correct
  • DA permissions boundary grants permissions, so an action allowed only by the boundary is permitted even with no identity policy.
  • EWhen evaluation finds at least one Allow and no Deny, the most recently created policy alone decides the outcome.
IAM evaluation begins with an implicit deny, requires an explicit allow, and lets any explicit deny override every allow across all applicable policy types. IAM evaluates every applicable policy together. The request is denied unless something explicitly allows it, which is the implicit deny baseline, and a single explicit Deny in any identity, resource, boundary, or organisation policy overrides all Allows. Boundaries only set a ceiling and never grant access, and policy age plays no part in the decision.

Why A is correct: Explicit deny always wins in IAM evaluation, taking precedence over every allow no matter where the allow originates.

Why B is wrong: This inverts the rule; an explicit deny in any policy, including a resource-based one, beats an allow elsewhere.

Why C is correct: IAM starts from an implicit deny, so an action that is never explicitly allowed is rejected even without any deny statement.

Why D is wrong: A boundary only caps the maximum permissions; it never grants access, so an identity policy allow is still required.

Why E is wrong: Policy creation time is irrelevant to evaluation; IAM considers all applicable policies together, not the newest one alone.

See more SAA-C03 practice questions, answers explained.

More in this domain

Back to all Design Secure Architectures objectives, or the SAA-C03 cert hub.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.