A user has set the IAM policy where it denies all requests if a request is not from IP 10.10.10.1/32. The other policy says allow all requests between 5 PM to 7 PM. What will happen when a user is requesting access from IP 55.109.10.12/32 at 6 PM?
A.
It will deny access
B.
It is not possible to set a policy based on the time or IP
Suggested Answer:A🗳️
When a request is made, the AWS IAM policy decides whether a given request should be allowed or denied. The evaluation logic follows these rules: By default, all requests are denied. (In general, requests made using the account credentials for resources in the account are always allowed.) An explicit allow policy overrides this default. An explicit deny policy overrides any allows. In this case since there are explicit deny and explicit allow statements. Thus, the request will be denied since deny overrides allow. Reference: http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_EvaluationLogic.html
there is no conflict with time
Source Ip is wrong, user will be able to access but IAM will throw an error, example:
An error occurred describing your selected AMI
You are not authorized to perform this operation.
CIDR 10.10.10.1/32
First IP 10.10.10.1
Last IP 10.10.10.1
CIDR 55.109.10.12/32
First IP 55.109.10.12
Last IP 55.109.10.12
Since we have different IPs don't confused with time simple follow standard rule
By default, all requests are denied
"The other policy says allow all requests between 5 PM to 7 PM"]
How to do this?
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Date
says it has to specify date and "Wildcards are not permitted for date condition operators"
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
hilft
2 years, 9 months agohilft
2 years, 9 months agojj22222
3 years, 3 months agoYecine11y
3 years, 3 months agocldy
3 years, 4 months agoExtHo
3 years, 6 months agonewme
3 years, 6 months agoDuyPhan
3 years, 6 months agoNKnab
3 years, 7 months agoOleksandr
3 years, 7 months agomeenu2225
3 years, 6 months ago