IAM Policy Evaluation: DENY vs ALLOW, Boundaries, and Cross-Account Roles

Understand how AWS evaluates IAM policies by creating real resources and observing the results first-hand.

You'll learn to:

• Create IAM users, groups, and attach managed policies
• Prove that an explicit DENY always overrides any ALLOW
• Use permission boundaries to cap the effective permissions of a role
• Assume a role that requires an external ID for cross-account trust

Key Resources:

• IAM Policy Evaluation Logic
• Permission Boundaries
• External ID for Cross-Account Access