In AWS, a role has one policy that allows s3:DeleteObject and another that denies it. What happens?

This is a staple cloud-IAM question because many engineers carry over a "most specific rule wins" intuition from firewalls. AWS works differently.

The rule

AWS's policy evaluation logic documentation states that for same-account access the resulting permissions are the union of identity-based and resource-based policies, and that "an explicit deny in either of these policies overrides the allow." The same sentence recurs for permissions boundaries, service control policies (SCPs) and resource control policies (RCPs).

Putting it together

• Default: everything is denied unless some policy allows it (implicit deny).
• Allow: grants access only if nothing explicitly denies it, and only within the intersection of any boundary, SCP or RCP that applies.
• Explicit Deny: always wins. Order, specificity and which policy type carries it are irrelevant.

So in the scenario, the s3:DeleteObject request fails.

Why it matters

Explicit denies are how you build durable guardrails: an SCP denying cloudtrail:StopLogging or actions outside approved regions cannot be undone by an administrator's own Allow in the account. During troubleshooting, an "AccessDenied" despite a visible Allow usually means a Deny (or a missing allow in a boundary/SCP) somewhere else.

Why the distractors are tempting

"Most specific wins" and "Allow in identity policy wins" come from other systems or wishful thinking. "Alphabetical order" is invented; evaluation is not order-dependent.

What interviewers want

"Explicit deny always wins; absent that, you need an allow in every applicable layer." Bonus for mentioning SCPs as guardrails.