AWS evaluates effective permissions by combining identity-based policies, resource policies, permission boundaries, service-control policies, session policies, and ACLs. IPTables is a host-level Linux firewall that operates after the AWS authorization decision and is never examined in the IAM evaluation logic, so it plays no part in calculating a principal’s net effective permissions.

A. IAM policies are the primary identity-based policies whose statements are evaluated for every request.

B. Permission boundaries act as an upper limit on the permissions that a principal’s policies can grant.

D. Service Control Policies are organization-level guard-rails that are evaluated with every authorization decision.

1. AWS IAM User Guide

“Policy evaluation logic”

Steps 1-7

paras 2-4 (https://docs.aws.amazon.com/IAM/latest/UserGuide/referencepoliciesevaluation-logic.html)

2. AWS Organizations User Guide

“How SCPs work”

section “Impact on authorization”

para 1 (https://docs.aws.amazon.com/organizations/latest/userguide/orgsmanagepoliciesscps.html)