Cloud & Infrastructure
Bug Report
An IAM policy with Allow and NotAction quietly granted IAM admin: reading what policies really allow
A developer role was meant to allow everything except IAM changes. Its policy used Allow with NotAction, yet a review found it could create access keys for other users and assume an admin role. How we found it with the policy simulator and Access Analyzer, and rewrote it safely.