Policy Evaluation Logic

Policy evaluation is a critical aspect of managing access to resources within the Amazon Web Services (AWS) environment. AWS employs a sophisticated policy evaluation process to determine whether to allow or deny requests for accessing resources based on the permissions defined in policies.

How policy evaluation works

The evaluation process begins with the request context, which includes information about the actions requested, the AWS resource involved, details about the principal making the request (such as associated policies), environmental data, and resource-specific data.

AWS evaluates policies in a specific order, starting with identity-based policies and progressing through resource-based policies, IAM permissions boundaries, and other policy types. An explicit deny in any policy overrides an allow.

Let’s look at the common rules for the policy evaluation:

• Allow vs. deny: If at least one policy explicitly allows the requested action and no policy explicitly denies it, the request is allowed. However, if any policy explicitly denies the action, the request is denied, regardless of any other policies that might allow it.

• Implicit deny: If no policy explicitly allows the requested action, the default behavior is an implicit deny, meaning the request is denied by default. IAM principals must be explicitly allowed to perform actions.

• Impact of policy types: Each policy type has its own rules for evaluation and can affect the final decision. For example, IAM permissions boundaries set the maximum permissions that an identity-based policy can grant, while AWS Organizations SCPs specify the maximum permissions for an organization or organizational unit. The diagram below depicts the flow in which a policy is evaluated.