As your environment grows, so will your users, groups, roles, and resources. As a result, there will be times when an identity will have multiple policies that affect it, so how does AWS manage the logic of these policies?
When a request is received to gain access to a resource within AWS, the following four steps are performed to determine the permissions allowed:
- Authentication: AWS determines who the principal of the request is by way of authentication.
- Determine the context of the request: The access request is processed to define which policies should be used for permission verification. In this step the actions, resources, principals, environment data, and resource data are examined.
- Policy evaluation: AWS evaluates the policy types being used as a specific order is applied when processing the policies to determine the evaluation of permissions within a single account. Policies will be evaluated in the order of identity-based, resource-based, IAM permissions boundaries...