Troubleshooting access denied and policy evaluation: SCS-C03 study notes and practice questions
What to know about Troubleshooting access denied and policy evaluation for the SCS-C03 exam, from the Identity and Access Management domain (20% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.
These questions give an access-denied error, a policy that looks like it allows the action, and a request to find the cause or the right fix. The exam tests whether you can walk the evaluation order in your head and name the layer that blocks the request, rather than adding another allow statement.
The facts that decide answers
Explicit deny wins. An explicit deny in any applicable policy blocks the request, even if other policies allow it.
Every applicable layer must allow. For a request in one account, an SCP or RCP that applies must allow it, and then either an identity-based policy or a resource-based policy must allow it.
Permissions boundaries and session policies each must allow the action when they are present, because they limit the identity’s effective access.
Cross-account requests need an allow from the caller’s identity policy in its own account and from the resource’s policy in the other account.
Implicit deny is the default. If nothing allows the action, the request fails.
SCPs and RCPs do not apply to the management account, and they do not apply to service-linked roles.
KMS needs an allow in the key policy. An IAM policy alone does not open a key.
Other gates: VPC endpoint policies, S3 Block Public Access, and resource policies can each block a request that the identity policy allows.
Diagnosis: the CloudTrail record shows the action, resource and principal, and the IAM policy simulator tests a policy before you deploy it.
How to choose
Scenario wording
Pick
Action is allowed by the role’s policy but still denied
Look for an explicit deny, an SCP, a permissions boundary or a session policy
Cross-account action is denied
Check both the caller’s identity policy and the resource’s policy
Admin with broad IAM rights cannot use a KMS key
Check the key policy
Object access denied despite a bucket allow
Check S3 Block Public Access, the object’s KMS key and any VPC endpoint policy
Access denied only from inside a VPC
Check the VPC endpoint policy
Need to test a policy before deploying it
IAM policy simulator
Need to know which layer denied a call
CloudTrail record, then policy simulation
Common traps
Adding an allow when the real blocker is an explicit deny somewhere else.
Assuming a resource-policy allow is enough for a principal in another account, without the caller’s identity policy.
Blaming the identity policy when an SCP denies the action across the organization.
Believing SCPs apply to the management account. They do not.
Expecting an IAM policy to grant KMS access with no key policy allowing it.
A media company runs its video encoding team in a member account that sits in the Workloads OU. The OU has a service control policy (SCP) that denies EC2 actions outside three approved Regions, to keep processing in approved locations.
A new GPU project needs instances in ap-southeast-2 from the same account. The team's IAM role already allows ec2:RunInstances, but every launch fails with an explicit deny. Security does not want the other accounts in the OU to gain that Region, and nobody may change the management account.
Which change meets these requirements?
Choose one answer.
AA. Add an Allow statement for ec2:RunInstances in ap-southeast-2 to the encoding team's IAM role. The role policy then grants the access, so the launches succeed without changing any SCP.
BB. Add ap-southeast-2 to the approved Regions in the SCP attached to the Workloads OU. Every account in the OU will then be able to launch instances in that Region, which is the simplest way to fix the problem.
CC. Move the account to a new OU with its own SCP that allows the GPU Region. Keep the existing deny on the Workloads OU for every other account, which then stays restricted.
DD. Attach a new SCP to the encoding account that allows ec2:RunInstances in ap-southeast-2. Because the new policy is attached closer to the account, its allow takes precedence over the deny on the Workloads OU.
Show the answer and explanation
Answer: C
A. Wrong: An IAM allow cannot override an explicit deny in an SCP, so the launches would still fail. SCPs set the outer limit for the account, and only a change to the SCP or to the account placement can lift that limit.
B. Wrong: The change works for this project, but it opens the Region for every account in the OU. Security wants the other accounts to stay restricted, so this option breaks the stated requirement.
C. Right: Correct. Moving the account out of the Workloads OU removes it from that deny, and the new OU SCP can allow the Region for this account alone. Other accounts stay restricted, and the management account is not changed. Learn more: Service control policies evaluation (opens in a new tab)
D. Wrong: SCPs do not take precedence by how close they are to the account. An explicit deny in any SCP on the path from the root to the account still blocks the action, so the inherited deny keeps applying.
Explanation
An explicit deny in any SCP on the path from the root to an account blocks the action, and an IAM allow cannot override it. Moving the account to its own OU with a policy that allows the Region isolates the change to that account. Editing the shared OU policy, or attaching an allow SCP, misses the stated constraints.
Want more on Troubleshooting access denied and policy evaluation? The 5 full-length practice sets have 6 more Troubleshooting access denied and policy evaluation questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Troubleshooting access denied and policy evaluation