Policy Evaluation

The chain that decides every single request: an explicit deny anywhere wins, and then every applicable layer — organization policies, resource policy, permissions boundary, session policy, identity policy — must allow it. Reading policy documents precisely, the condition keys the exam leans on, cross-account authorization service by service, and the four capping policy types compared.

Content current as of 2026-10.

Lessons

1. The evaluation chain
2. Reading a policy precisely
3. Conditions in depth
4. Cross-account authorization
5. Boundaries, SCPs, and delegation

Sources

• SCS-C03 exam guide — Content Domain 4 (tasks 4.1–4.2)
• IAM User Guide — policy evaluation logic
• IAM User Guide — AWS global condition context keys
• AWS Organizations user guide — resource control policies (RCPs)
• AWS KMS developer guide — key policies