Cloud Engineer interview question · Most asked
How is an AWS IAM request evaluated when several policies apply?
Summary
By default everything is denied. If any applicable policy (identity, resource, permission boundary, SCP, session policy) has an explicit Deny matching the request, it's denied. Otherwise it's allowed only if an Allow matches and every guardrail layer (SCPs, boundaries, session policies) also permits it.
Longer Answer
Resource policies can grant cross-account access, but the caller's account must also allow it. Conditions (source IP, MFA, tags, region) refine statements. Tools: IAM policy simulator and Access Analyzer.
Key Points
- Implicit deny by default.
- Explicit deny always wins.
- Allow needed, within all guardrails.
- Conditions refine; simulate to verify.
Deep dive: Cloud Computing Tutorial: How Policies Are Evaluated
Explanation
What interviewers look for
The precedence rules and the layers that can restrict.
More most-asked Cloud Engineer questions
- What do Multi-AZ deployments and read replicas give you for managed databases?
- How do you eliminate long-lived credentials in a cloud environment?
- What are regions and availability zones, and how do you use them for resilience?
- How do you keep object storage buckets from being exposed publicly?
- How do you approach cloud cost optimisation?
- Explain RTO and RPO and the four disaster recovery strategies.
- How would you design a multi-account (landing zone) structure?
- What security services and settings belong in every cloud account from day one?