Ravi Sir's Cards › AWS
Deny-false or Allow-true?
This comparison card contrasts Deny-false or Allow-true. Explicit Deny insecure is described as deny wins against other Allows. It also notes closes holes. Allow only if SecureTransport true: Easy to bypass if another Allow exists. The card pairs Explicit Deny insecure with default pattern, and Allow only if SecureTransport true with insufficient alone.
Read card text
What this card says
Deny-false or Allow-true?
Explicit Deny insecure
Deny wins against other Allows; closes holes.
Allow only if SecureTransport true
Easy to bypass if another Allow exists.
Key points
All regulated buckets.
Never alone in multi-statement policies.
Example
Bool aws:SecureTransport false Deny / Bool true Allow
Use when
Default pattern.
Insufficient alone.