AWS Access
What is explicitly denied
Thirty-six data-plane actions are denied outright, so object contents, database rows, log events and secrets cannot be read at all.
A read-only role can still read your data. ReadOnlyAccess grants s3:GetObject, DynamoDB item reads and ssm:GetParameter — customer data, not governance metadata.
The GovIntel assessment role therefore carries explicit Deny statements, which override every grant including those inherited from the managed policies.
Denied outright
| Class | Examples |
|---|---|
| Object contents | s3:GetObject, s3:GetObjectVersion, s3:ListBucket |
| Database records | dynamodb:GetItem, dynamodb:Query, dynamodb:Scan, dynamodb:PartiQLSelect |
| Secrets | secretsmanager:GetSecretValue, ssm:GetParameter, ssm:GetParametersByPath |
| Cryptographic material | kms:Decrypt, kms:GenerateDataKey, kms:ReEncryptFrom |
| Log contents | CloudWatch Logs event reads |
An explicit Deny in IAM cannot be overridden by any Allow. This is not a convention GovIntel follows; it is a property of the policy evaluation.
What this costs
The boundary has a price, and disclosing it is the point.
Three families of scanner check cannot run because the actions they need are denied:
- checks that read CloudWatch Logs event content
- checks that download Lambda deployment packages to scan them for embedded secrets
- checks that read S3 object contents or enumerate objects
Those checks are absent from your assessment. The alternative — granting the reads so the checks can run — would mean GovIntel could read your data, which is the trade this product declines to make.