Hints — Access Denied I - Lab 01

Open each hint only after you’ve spent time investigating on your own.

---

Hint 1 — Where to look

The role has a permissions policy attached, and it isn’t empty. Open the role in the IAM console and review its Permissions tab.

---

Hint 2 — What to look for

Look at the Action list in the inline policy statement. Which S3 actions are listed? Reading an object and listing a bucket’s contents are two different API actions.

---

Hint 3 — The gap

The policy grants s3:ListBucket (list the bucket’s contents) but never grants s3:GetObject (read an object’s contents). Without an explicit Allow for s3:GetObject, IAM’s default is to deny it — this is called an implicit deny.

---

Spoiler Alert — Full Solution

Root cause: The role’s inline policy only grants s3:ListBucket. It never grants s3:GetObject, so any request to read an object is implicitly denied — IAM denies by default unless a policy explicitly allows the action.

---

To fix the policy:

1. Open the IAM console and select the role from the stack Outputs
2. Open the Permissions tab, find the inline policy, and click Edit
3. Add s3:GetObject to the Action list alongside s3:ListBucket
4. Click Next > Save changes
5. Re-run the simulation for s3:GetObject in the IAM Policy Simulator — it should now show allowed

If you’re using the Simulate button inside the IAM console’s policy editor, remember to set an explicit Resource ARN for each action instead of leaving the default * — testing against * shows denied regardless of the policy, since this policy only grants access to a specific bucket:

• s3:ListBucket → the BucketResourceArn value from Outputs
• s3:GetObject → the ObjectResourceArn value from Outputs

---

References

• Adding and removing IAM identity permissions
• Actions, resources, and condition keys for Amazon S3