hard20 pts · first answer countscloud-securityiam-policiess3

Deny with NotPrincipal

A bucket policy uses "Effect": "Deny" with "NotPrincipal" listing an admin role ARN, intending to block everyone else. Admins assuming that role are still denied. Why?

A.NotPrincipal can only list AWS service principalsB.Sessions use an assumed-role ARN, not the role ARN listedC.Deny statements in bucket policies never apply to rolesD.The bucket needs versioning for NotPrincipal to work

Discussion 0

Join free to post in the discussion.

Deny with NotPrincipal

Discussion 0

Related questions