A role has an identity policy allowing s3:* and a permissions boundary allowing only s3:GetObject. What can the role actually do?
A.Everything s3:* allows — identity policy wins
Boundaries override — they set the ceiling regardless of grants.
B.Only s3:GetObject — effective permissions are the intersection
Intersection semantics. Correct.
C.Nothing — the policies conflict
No conflict — overlap is computed, not errored.
D.Whatever the boundary allows plus s3:*
Union is wrong — boundaries restrict, never expand.
Why this answer
Permissions boundaries are maximum-permission ceilings: effective = identity policy ∩ boundary (and ∩ SCP if orgs). The role gets GetObject only — the boundary can't grant, only constrain. Classic least-privilege delegation pattern.
Correct answer: B · Last reviewed 2026-11-05
Official AWS references
Practice this interactively
Answer without seeing the solution first in the IAM Deep Dive practice session.
Practice IAM Deep Dive