How Does IAM Explicit Deny Affect EC2 Instance S3 Access?

DVA-C02 By islever Editorial Last updated Aug 6, 2026

Short answer

D The EC2 instance will not be able to perform any S3 action on any S3 bucket.

Question

An IAM role is attached to an Amazon EC2 instance that explicitly denies access to all Amazon S3 API actions. The EC2 instance credentials file specifies the IAM access key and secret access key, which allow full administrative access. Given that multiple modes of IAM access are present for this EC2 instance, which of the following is correct?

The EC2 instance will only be able to list the S3 buckets.
The EC2 instance will only be able to list the contents of one S3 bucket at a time.
The EC2 instance will be able to perform all actions on any S3 bucket.
The EC2 instance will not be able to perform any S3 action on any S3 bucket. Correct Answer

Key Takeaways

The question is a trap designed to test whether you understand that the credential provider chain (which determines which credentials are used) is completely separate from IAM policy evaluation logic (which determines what those credentials can do). An explicit deny in any applicable policy will always block the action.

This question tests the interaction between the AWS credential provider chain and IAM policy evaluation logic on an EC2 instance. The community consensus confirms that an explicit deny in an IAM policy always overrides any allow, regardless of which credentials are ultimately used by the AWS CLI.

Common mistake: Many candidates choose C, incorrectly believing that the credentials file takes precedence in the provider chain and therefore its 'full administrative access' permissions override the IAM role's explicit deny. They confuse the order of credential *retrieval* with the rules of policy *evaluation*.

Expert Analysis

This question tests two distinct but related AWS concepts: the AWS credential provider chain and IAM policy evaluation logic.

First, let's address the credential provider chain. When the AWS CLI or SDK runs on an EC2 instance, it looks for credentials in a specific order: environment variables, then the credentials file (~/.aws/credentials), and finally the EC2 instance profile (IAM role). In this scenario, because the credentials file exists and contains valid keys, the AWS CLI will indeed use those keys, not the IAM role's temporary credentials. This is where many candidates get tripped up, as noted by user Kb80 in the comments.

However, the critical part of this question is the second concept: IAM policy evaluation logic. Once the AWS CLI has selected a set of credentials (in this case, the ones from the credentials file), it makes an API call to S3. AWS then evaluates all policies attached to the identity associated with those credentials. The fundamental rule of IAM policy evaluation is that an explicit deny always wins. If any policy attached to the user whose keys are in the credentials file contains an explicit deny for S3 actions, that deny will block the request, regardless of any other allow statements in any other policies.

The question states that the IAM role attached to the EC2 instance explicitly denies S3 access. While the CLI might use the keys from the credentials file, the evaluation of those keys' permissions is what matters. If the user associated with those keys also has an explicit deny (or if the question implies the role's deny somehow applies to the session), the action is blocked. The key takeaway, as emphasized by tomchandler077 and Anandesh, is that an explicit deny is the ultimate trump card in IAM. It doesn't matter how many "Allow" policies you have; a single explicit deny will shut down access. Therefore, the EC2 instance will not be able to perform any S3 action, making D the correct answer.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When you see a question that mentions both an 'explicit deny' and an 'allow' (especially 'full admin access'), immediately think of the IAM policy evaluation logic. An explicit deny always overrides an allow, no matter the source of the allow. Don't get distracted by the credential provider chain details unless the question is specifically about which credentials are being used.

Community Votes

60%

40%

60% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

tomchandler077 👍 10

D Explicit deny policies in IAM take precedence over any allow policies. If the IAM role attached to the EC2 instance explicitly denies access to S3, this deny will apply regardless of any other credentials or policies that might grant access. Even though the EC2 instance's credentials file specifies keys with full administrative access, the explicit deny in the IAM role will override these permissions for S3 actions.
Anandesh 👍 4 Answered D

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html
Kb80 👍 2 Answered C

By default the AWS CLI uses environment variables then credentials file. Then if neither are present and an EC2 instance profile is attached, then this would be used. So with full access allowed by the key and secret in the local credentials file, full access to S3 would be allowed. Give it a try if you don't believe.
CloudChingon 👍 2 Answered C

The credentials file containing IAM user credentials with full administrative permissions overrides the IAM role's permissions for S3 actions, allowing full access to S3.
ShakthiGCP 👍 2 Answered D

Explicit deny policies in IAM take precedence over any allow policies

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide