Blog · Domain
Security
2 articles, each explaining one topic from the documentation and ending at a stage you can play.
The Security domain36 stages, about 18.5 hours, $25
SCS-C03 · Security
How AWS decides a request: why an explicit deny always wins
Every request starts denied. An Allow lets it through, and one Deny in any policy ends it. The order AWS reads policies in, and how to find the Deny.
Ends at Deny WinsFree5 min read · video coming
SCS-C03 · Security
Identity policy or bucket policy: which one has to allow?
In one account, either side can allow. Across accounts, both must. An account principal only delegates, and Block Public Access overrides a public policy.
Ends at Deny WinsFree6 min read · video coming