Ravi Sir's Cards › AWS
Explicit Deny vs default deny?
What is a VPC: your own private network inside one AWS Region, example ThreeTierVpc 10.0.0.0/16.
Read card text
What this card says
What it is
Default deny: if nothing Allows the action, it is denied. Explicit Deny: a Deny statement overrides any Allow from other policies.
Explicit Deny
Why it matters
SCPs, permission boundaries, and resource policies participate too — an Allow on the role is not the whole story.
How / example
Allow s3:* plus Deny s3:DeleteBucket still blocks delete — Deny wins. Missing Allow alone is enough to deny ListBucket.