iam policy evaluation derived

{
  "input": {
    "body": {
      "policies": [
        {
          "name": "identity",
          "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n  {\n   \"Sid\": \"ReadExports\",\n   \"Effect\": \"Allow\",\n   \"Action\": [\n    \"s3:GetObject\"\n   ],\n   \"Resource\": [\n    \"arn:aws:s3:::exports/*\"\n   ]\n  },\n  {\n   \"Sid\": \"DenyProduction\",\n   \"Effect\": \"Deny\",\n   \"Action\": [\n    \"s3:DeleteObject\"\n   ],\n   \"Resource\": [\n    \"arn:aws:s3:::production/*\"\n   ]\n  }\n ]\n}"
        },
        {
          "name": "boundary",
          "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n  {\n   \"Sid\": \"AllowWriteFromOffice\",\n   \"Effect\": \"Allow\",\n   \"Action\": [\n    \"s3:PutObject\"\n   ],\n   \"Resource\": [\n    \"arn:aws:s3:::exports/*\"\n   ],\n   \"Condition\": {\n    \"IpAddress\": {\n     \"aws:SourceIp\": \"203.0.113.0/24\"\n    }\n   }\n  },\n  {\n   \"Sid\": \"DenyEverythingElse\",\n   \"Effect\": \"Deny\",\n   \"NotAction\": [\n    \"s3:GetObject\",\n    \"s3:PutObject\"\n   ],\n   \"Resource\": \"*\"\n  }\n ]\n}"
        }
      ],
      "requests": [
        {
          "action": "s3:GetObject",
          "resource": "arn:aws:s3:::exports/report.csv"
        },
        {
          "action": "s3:DeleteObject",
          "resource": "arn:aws:s3:::production/report.csv"
        },
        {
          "action": "s3:PutObject",
          "resource": "arn:aws:s3:::exports/new.csv"
        },
        {
          "action": "dynamodb:GetItem",
          "resource": "arn:aws:dynamodb:us-east-1:123456789012:table/orders"
        }
      ]
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxEnvBytes": 131072,
        "maxFindings": 500,
        "maxPlanBytes": 4194304,
        "maxResources": 5000,
        "maxStatements": 500,
        "maxPolicyBytes": 262144
      },
      "passed": false,
      "complete": false,
      "findings": [
        {
          "code": "REQUEST_ALLOWED",
          "pair": "s3:GetObject on arn:aws:s3:::exports/report.csv",
          "detail": "s3:GetObject on arn:aws:s3:::exports/report.csv is allowed. identity ReadExports allows it and no statement denies it."
        },
        {
          "code": "REQUEST_UNDETERMINED",
          "pair": "s3:PutObject on arn:aws:s3:::exports/new.csv",
          "detail": "s3:PutObject on arn:aws:s3:::exports/new.csv cannot be decided from these documents. boundary AllowWriteFromOffice allows it only under a Condition, which depends on the request context."
        }
      ],
      "requests": [
        {
          "action": "s3:GetObject",
          "reason": "identity ReadExports allows it and no statement denies it.",
          "decision": "allowed",
          "resource": "arn:aws:s3:::exports/report.csv",
          "matching_deny_count": 0,
          "matching_allow_count": 1
        },
        {
          "action": "s3:DeleteObject",
          "reason": "identity DenyProduction denies it. An explicit Deny overrides every Allow.",
          "decision": "denied",
          "resource": "arn:aws:s3:::production/report.csv",
          "matching_deny_count": 1,
          "matching_allow_count": 0
        },
        {
          "action": "s3:PutObject",
          "reason": "boundary AllowWriteFromOffice allows it only under a Condition, which depends on the request context.",
          "decision": "undetermined",
          "resource": "arn:aws:s3:::exports/new.csv",
          "matching_deny_count": 0,
          "matching_allow_count": 1
        }
      ],
      "all_denied": false,
      "request_id": "example-request",
      "service_id": "iam_policy_evaluation",
      "assumptions": [
        "Evaluation follows IAM order: an explicit Deny wins over every Allow, and the absence of an Allow is a denial because there is no implicit allow.",
        "A statement carrying a Condition is reported as undetermined rather than decided either way, because the condition depends on a request context that is not supplied. Guessing would produce a confident...",
        "A NotAction or NotResource statement is not evaluated, because its permitted set is defined by exclusion from the whole cloud. That is said per statement rather than silently skipped."
      ],
      "limitations": [
        "The policies supplied against the requests supplied. Permission boundaries, organisation and service control policies, session policies and resource policies attached elsewhere are all outside this, s...",
        "all_denied is true only when every request was decided and every one of them was denied. Not a security assessment."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "denied_count": 2,
      "not_examined": [
        "STATEMENT_NOT_EVALUATED: boundary DenyEverythingElse uses NotAction or NotResource, whose permitted set is defined by exclusion from the whole cloud, so it was not evaluated against any request."
      ],
      "policy_count": 2,
      "allowed_count": 1,
      "finding_count": 2,
      "request_count": 4,
      "service_version": "1.0.0",
      "statement_count": 4,
      "findings_by_code": {
        "REQUEST_ALLOWED": 1,
        "REQUEST_UNDETERMINED": 1
      },
      "undetermined_count": 1
    }
  }
}