AWS IAM Policy Evaluation: A Quick Walkthrough with Java

"Why is my S3 request denied? I literally have an Allow for it." If you have worked with AWS for more than a week, you have hit this. Getting unstuck starts with how IAM evaluates policies - and while the full evaluation has several layers, the core rules are simpler than they feel once you see them in code.

In this walkthrough we will look at three rules at the core of identity-based policy evaluation inside a single AWS account, then simulate them in a small Java program you can run yourself. This is a simplified identity-policy example, not the full IAM evaluation: the real engine also layers in resource-based policies, permissions boundaries, Organizations SCPs/RCPs, session policies, and conditions, which this demo intentionally leaves out.

The three rules (single account)

Per the AWS policy evaluation logic docs :

By default, everything is denied (implicit deny).…