Explicit deny

Definition

An explicit deny is a statement in any applicable policy whose Effect is Deny. In AWS IAM policy evaluation it is checked first, across every policy type in scope, and a match ends the request: no later stage is reached and no Allow anywhere in the set survives it. It is the only mechanism in the procedure that overrides a grant rather than capping one.

The problem

Deny is the one mechanism that cannot be worked around by adding a grant elsewhere, which makes it the most dangerous line in a policy set. A Deny written to exclude a handful of principals can, through the NotPrincipal and permissions-boundary interaction, exclude every governed principal in the account - and still read correctly in review.

Why it matters

A denial caused by a matching Deny and a denial caused by an absent Allow produce the same API response and opposite fixes. The first is repaired by narrowing or removing a statement; the second by adding a grant, which changes nothing at all against a matching Deny. Telling them apart is the first step of any authorisation investigation.

Practical example

An identity policy allows s3:GetObject and a bucket policy denies the same action for the same principal. The request is denied at stage one, before the identity-based Allow is consulted - and re-granting in the identity policy cannot change the outcome.

How RELIASTRA approaches it

RELIASTRA keeps the same distinction in its own records: a dependency refusing a request is a different observation from a request that was never made, and neither is inferred from the other. An absence is reported as an absence.