An architect is reasoning about how IAM decides whether a single API request is allowed when the calling principal is subject to an identity-based policy, a resource-based policy, and a permissions boundary. To predict the outcome correctly, which TWO statements about IAM policy evaluation are true? Select TWO.
- AAn explicit Deny in any applicable policy overrides any Allow, so the request is denied regardless of how many policies allow it. Correct
- BAn Allow in the identity-based policy overrides an explicit Deny in the resource-based policy when both target the same action.
- CIf no policy explicitly allows the action, the request is denied by default through an implicit deny. Correct
- DA permissions boundary grants permissions, so an action allowed only by the boundary is permitted even with no identity policy.
- EWhen evaluation finds at least one Allow and no Deny, the most recently created policy alone decides the outcome.
Why A is correct: Explicit deny always wins in IAM evaluation, taking precedence over every allow no matter where the allow originates.
Why B is wrong: This inverts the rule; an explicit deny in any policy, including a resource-based one, beats an allow elsewhere.
Why C is correct: IAM starts from an implicit deny, so an action that is never explicitly allowed is rejected even without any deny statement.
Why D is wrong: A boundary only caps the maximum permissions; it never grants access, so an identity policy allow is still required.
Why E is wrong: Policy creation time is irrelevant to evaluation; IAM considers all applicable policies together, not the newest one alone.