Ravi Sir's Cards › AWS
Explicit Deny always wins
What is a VPC: your own private network inside one AWS Region, example ThreeTierVpc 10.0.0.0/16.
Read card text
What this card says
Why do we need it?
Students think “I attached AdministratorAccess so Deny cannot matter” — then SCP or explicit Deny blocks them.
What is it?
Default deny means no Allow. Explicit Deny overrides any Allow. Evaluation checks all applicable policies including SCPs and boundaries.
Explicit Deny
How to do it
Use explicit Deny to document “never from outside this IP” even if a future broad Allow appears.
Example
Allow s3:* plus Deny s3:DeleteObject still blocks deletes — Deny wins.