Code10x
IAMhard5-8 years

Two failures in one week. (1) A service's role allows `s3:GetObject` on `arn:aws:s3:::reports/*`, nothing on the role denies anything, yet a batch job using a library that defaulted to plain HTTP gets `AccessDenied`. (2) An analytics account's role is given a bucket policy statement allowing it to read the same bucket, and it is still denied. Walk the evaluation for each.

IAM evaluation is not first-match and not file order. Every applicable policy is considered, identity and resource together: first any matching explicit Deny anywhere ends it; otherwise an Allow in either the identity policy or the resource policy is enough within one account; otherwise the default deny stands. (1) The bucket policy has a Deny on requests where aws:SecureTransport is false. The request was plain HTTP, the deny matches, and it wins before the role's allow is even relevant; adding more allows cannot help, and the fix is the client using TLS. (2) Across accounts one side is not enough: the resource owner's policy must allow the external principal and that principal's own identity policy must allow the action. The analytics role has no identity policy granting s3:GetObject on this bucket, so it is denied.

The lesson behind it →
PreviousAn ECS service behind an ALB has its target group health check pointed at `/actuator/health`, which includes the database. During a 10-minute RDS incident the dashboard shows 0 healthy targets, yet some requests still reach the tasks, and ECS keeps replacing tasks that never finish starting. Explain the health check's semantics on an ALB, the fail-open behaviour, and what you would change.Next A security review adds a custom network ACL to the private subnets hosting a service: inbound allows 8080 from the load balancer subnets, outbound allows 5432 to the database subnets, everything else denied. The security groups did not change. Now every database query times out. Explain precisely why, and what the correct ACL looks like.
More on IAM
A Spring Boot service that worked yesterday now fails every upload with `AccessDenied` on `s3:PutObject` for `arn:aws:s3:::orders-uploads/invoices/2026/09/30/...`. Nobody admits to changing a policy. What are the only possible causes, and what is the first command you run?A service on ECS reads an access key and secret from `application.properties` (injected from a CI variable) to talk to S3 and Secrets Manager. You are asked to 'harden' it. What should replace the key, how does the SDK find credentials with no configuration, and what does the policy on the new identity look like?