# Exercise 1: Evaluate Ten Authorization Requests

For each request, decide **ALLOW** or **DENY** and name the deciding rule from the evaluation logic in `aws_iam_deep_dive_theory_1.md` §4.

**Setup (account 111111111111, in an Organization):**

- SCP on the account: `Deny` all actions when `aws:RequestedRegion` is not `eu-west-1` or `eu-central-1` (except global services); `Deny` `s3:DeleteBucket` everywhere.
- Role `app-api` identity policy: `Allow s3:GetObject, s3:PutObject` on `arn:aws:s3:::petpal-uploads/*`; `Allow dynamodb:*` on `table/orders`; permissions boundary `AppBoundary` allows `s3:*`, `dynamodb:Query`, `dynamodb:GetItem`, `dynamodb:PutItem`, `sqs:*`.
- Bucket `petpal-uploads` policy: `Deny` all actions when `aws:SecureTransport = false`; `Allow` `s3:GetObject` to `arn:aws:iam::222222222222:role/analytics`.
- Role `analytics` (account 222222222222) identity policy: `Allow s3:GetObject` on `*`.
- Queue `jobs` resource policy: `Allow sqs:SendMessage` to principal `arn:aws:iam::111111111111:role/app-api`.

**Requests:**

1. `app-api` → `s3:PutObject` on `petpal-uploads/a.jpg`, over HTTPS, eu-west-1.
2. `app-api` → `s3:PutObject` on `petpal-uploads/a.jpg`, over plain HTTP.
3. `app-api` → `dynamodb:DeleteItem` on `table/orders`.
4. `app-api` → `dynamodb:Query` on `table/orders` in `us-east-1`.
5. `app-api` → `sqs:SendMessage` to `jobs` (no SQS statement in its identity policy).
6. `analytics` (account 222…) → `s3:GetObject` on `petpal-uploads/report.csv` over HTTPS.
7. `analytics` → `s3:PutObject` on `petpal-uploads/x.csv`.
8. An admin role with `AdministratorAccess` → `s3:DeleteBucket` on `petpal-uploads`.
9. `app-api` → `s3:GetObject` on `petpal-uploads-backup/a.jpg`.
10. A new role created by a developer with `AdministratorAccess` attached and the permissions boundary `AppBoundary` → `iam:CreateUser`.

## Deliverables

Table: request # | decision | deciding rule (explicit deny / SCP / boundary / missing allow / resource policy grant / cross-account requirement) | one-line explanation.

## Requirements Checklist

- [ ] 1 ALLOW (identity allow, within boundary, no deny).
- [ ] 2 DENY (explicit deny in bucket policy for non-TLS).
- [ ] 3 DENY (identity allows `dynamodb:*` but the boundary doesn't include DeleteItem).
- [ ] 4 DENY (SCP region restriction).
- [ ] 5 ALLOW (same-account resource policy grant is sufficient, and the boundary allows `sqs:*`) — the answer notes the boundary caps identity-based grants and discusses the same-account role-principal case.
- [ ] 6 ALLOW (cross-account: caller identity allows AND bucket policy allows).
- [ ] 7 DENY (bucket policy grants only GetObject to the external role).
- [ ] 8 DENY (SCP explicit deny applies even to admins).
- [ ] 9 DENY (no identity allow on that bucket).
- [ ] 10 DENY (boundary doesn't allow IAM actions).