A municipal Lambda role is allowed kms:Decrypt by its identity policy, but sealed case PDFs still fail to open. An SCP on the account includes an explicit Deny for kms:Decrypt. What explains the failure?
Select an answer to reveal the explanation.
Short Explanation
In IAM, explicit Deny is the red stamp that cancels every Allow underneath it. An SCP or boundary Deny on kms:Decrypt will block the role no matter how friendly the identity policy looks. Fix the Deny path, not only the Allow.
Full Explanation
AWS policy evaluation gives explicit Deny precedence over Allow. An SCP or permissions boundary that denies kms:Decrypt will block decryption even when the role's identity policy allows the action. Developers troubleshooting sealed-PDF failures must check organization and boundary policies, not assume identity Allow is sufficient. SCPs do apply to KMS; Deny is not limited to the root user.