Explanation:
NotAction with Deny means: deny everything EXCEPT the listed actions. This is a common pattern to force MFA enrollment before allowing broader access.
Ultimate access to all questions.
What does the NotAction element in the following statement accomplish?
{
"Effect": "Deny",
"NotAction": [
"iam:CreateVirtualMFADevice",
"iam:EnableMFADevice",
"sts:GetSessionToken"
],
"Resource": "*"
}
{
"Effect": "Deny",
"NotAction": [
"iam:CreateVirtualMFADevice",
"iam:EnableMFADevice",
"sts:GetSessionToken"
],
"Resource": "*"
}
A
Allows only the three listed IAM/STS actions
B
Denies every action EXCEPT the three listed ones
C
Denies only the three listed actions
D
Has no effect because Effect is Deny with NotAction
No comments yet.