AWS Certified CloudOps Engineer - Associate
Policy Evaluation and Conditions
How AWS turns 6 competing policies into one allow or deny: the enforcement order, which policy types add permissions and which only subtract, permissions boundaries, and the condition operators and global condition keys that decide the close calls.
Advanced 30 minutes 6 Learning Objectives
- State the AWS enforcement order and name what happens at each gate
- Predict whether a given pair of policy types combines as a union or an intersection
- Explain why a permissions boundary can deny a request that an identity-based policy allows
- Choose the correct condition operator for a key, including the IfExists and Null forms
- Apply the rule that a missing condition key makes an ordinary condition false, and describe where that rule inverts
- Select the right global condition key for network, organization, MFA, and tagging restrictions