Prove an explicit deny beats an administrative allow
Task
Demonstrate the policy evaluation rules directly: build an identity with broad permissions, then stop it doing one specific thing with an explicit deny it cannot escape. This is the mechanism behind every organisational guardrail.
Steps
- Create an identity with a broad allow -- everything on a test resource group. Confirm it can create, modify and delete a resource, and record the evidence in
lab/eval.md. - Add a SEPARATE policy containing an explicit deny for one action, such as deleting a logging configuration. Attempt that action and capture the refusal.
- Attempt to remove the deny policy using the same identity, and record what happens. Then apply a boundary or organisational policy that prevents even that, and record the result.
- Add a CONDITION to one allow -- restrict it by tag, by region, or by requiring multifactor authentication. Show it succeeding when the condition is met and failing when it is not.
- Write the three-line summary: default deny, explicit allow permits, explicit deny always wins -- and the sentence about boundaries limiting rather than granting.
Verify
grep -Eci 'explicit deny' lab/eval.md
grep -Eci 'condition' lab/eval.md
grep -Eci 'boundary|organisation|organization|service control' lab/eval.md
grep -Eci 'limit(s)? rather than grant|does not grant' lab/eval.md
All four non-zero. The last check is the one people get wrong in exams: a boundary caps what an identity can have and never gives it anything.
This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.