amazon-web-servicesidentity-managementpolicies

Do the policies attached to IAM groups take precedence over the policies attached to individual IAM users?

I have a question let's assume I attached IAM policy "EC2FullAccess" to a user and then I added that specific user to a group but that group don't have "EC2FullAccess" Policy is he will still able to access to EC2?

Solution

  • No, one doesn't take precedence over the other. They are "combined". The user would have all the permissions applied to the group, plus all the permissions applied to their individual account.

    The exception is a Deny statement in a policy, which always takes precedence over any Allow statement.