Why Explicit Deny in S3 Bucket Policy Overrides IAM Allow
An IAM user receives an 'AccessDenied' error when trying to list objects in an S3 bucket. The user has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::example-bucket"}]}. What is the most likely reason?
Quick Answer
The answer is that an explicit deny in the S3 bucket policy overrides the IAM allow. This occurs because AWS authorization logic follows a strict hierarchy: explicit denies always take precedence over any allow, regardless of whether the allow comes from an IAM user policy or a resource-based bucket policy. In this scenario, the IAM policy grants s3:ListBucket, but the bucket policy contains an explicit deny for the same action, which is why the user receives an AccessDenied error. On the AWS Certified Security Specialty SCS-C02 exam, this concept tests your understanding of the "deny override" principle, often appearing as a trick where a seemingly sufficient IAM policy is silently blocked by a bucket policy. A common trap is assuming IAM allows are sufficient without checking resource-based policies. Memory tip: think of explicit deny as a "veto" — no matter how many "yes" votes (allows) you have, one "no" (explicit deny) kills the action.
⚠ Common exam trap
Many exam-takers assume an IAM policy alone is sufficient and forget that bucket policies can explicitly deny actions, overriding IAM allows, leading them to incorrectly choose options like missing permissions or syntax errors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The bucket policy explicitly denies the action
The IAM policy grants the s3:ListBucket action on the bucket, which should allow listing objects. However, an explicit deny in a bucket policy overrides any allow, including those from IAM policies. Since the user receives an 'AccessDenied' error, the most likely cause is that the bucket policy explicitly denies the s3:ListBucket action for this user, as explicit denies take precedence over all allows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy is missing a condition
Why it's wrong here
Conditions are not required.
- ✓
The bucket policy explicitly denies the action
Why this is correct
An explicit deny in the bucket policy overrides the user policy allow.
- ✗
The policy does not include s3:GetObject
Why it's wrong here
ListBucket is sufficient to list objects; GetObject is for reading objects.
- ✗
The policy has a syntax error
Why it's wrong here
The policy is valid JSON.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer is trying to use the AWS CLI to list objects in an S3 bucket but receives an AccessDenied error. The developer has an IAM user with a policy that allows s3:ListBucket on the bucket. What could be causing the error?
easy- A.The developer has not enabled MFA on their IAM user.
- ✓ B.The S3 bucket has a bucket policy that denies access to the developer's IAM user.
- C.The S3 bucket does not exist in the same AWS region as the CLI is configured.
- D.The IAM policy is attached to a group, not directly to the user.
Why B: The AccessDenied error indicates that the request was received but denied. Even though the IAM policy allows s3:ListBucket on the bucket, an explicit deny in the S3 bucket policy overrides any allow. Therefore, option B is correct because the bucket policy likely denies access to the developer's IAM user. Option A is incorrect: MFA is not required unless a condition is set. Option C is incorrect: S3 is a global service and bucket names are globally unique; region configuration does not affect this. Option D is incorrect: attaching a policy to a group still applies to the user as a member, so if the policy allows the action, it is effective.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.