Implicit deny

Definition

Implicit deny is the absence of an Allow. AWS denies every request by default, with the single documented exception of the account root user, so a request succeeds only if some applicable policy grants it and no statement denies it. Nothing was evaluated against the request except a search for a matching Allow, and the search came up empty.

The problem

Implicit deny produces no statement to point at. The defect is a missing line rather than a present one, and the absence usually sits in a different policy class from the one being read - most often a resource-based policy on the other side of the search, or a ceiling two stages earlier in the procedure.

Why it matters

Implicit deny is a safety property and an audit hazard at once. It is why an unattached role has no permissions and fails closed, and it is why "nothing denied it" is weak evidence of anything. A system that defaults to deny must record what granted each allowed request, or the grant stays invisible until it is wrong.

Practical example

A new IAM role with no policies attached returns AccessDenied on every call. So does a role whose identity policy allows the action but whose request is stopped by a service control policy two stages earlier. Both are implicit denials, at different stages, and only the deciding stage distinguishes them.

How RELIASTRA approaches it

RELIASTRA applies the same default to observation: a dependency that has never been checked is reported as unobserved rather than healthy, and a missed probe is never backfilled with a synthesised result. Absence of evidence is recorded as absence.