Prove allow and deny paths

What this card says

Why do we need it?

Only testing the happy path hides a broken Condition that never denies.

What is it?

With the conditioned role: succeed on the lab bucket from the allowed context; fail from a disallowed context (other IP, no MFA, or wrong region).

How to do it

Run aws s3 ls twice — once meeting the Condition, once violating it — and watch CloudTrail if available.

AccessDenied

Example

Same role ARN, two outcomes: Allow when Condition matches, AccessDenied when it does not.