Technical Concepts
Data-plane deny
Explicit denials that override every permission, which is what makes the read-only guarantee a property of the access rather than a promise.
Currentengine 9.0.0Verified 2026-08-30
What it is
A policy attached to the assessment role denying specific actions outright.
Why deny rather than simply not grant
Because the role also attaches two AWS managed policies, and those grant broadly. Not granting an action is not the same as denying it when something else in the policy set might.
An explicit deny in IAM overrides every allow, including managed ones. That is what makes these binding.
What is denied
| Class | Examples |
|---|---|
| Object and record content | Object retrieval and enumeration, database item, query and scan operations, query-result retrieval |
| Secrets and cryptographic material | Secret retrieval, parameter retrieval including history, decrypt, data key generation, re-encryption |
| Log and stream content | Log event retrieval, log queries, queue and stream reads |
| Code and images | Function package retrieval, function invocation, container image retrieval |
| Lateral movement | Assuming other roles, and passing roles |
Why parameter history is named separately
Because it returns previous parameter values. Denying the three obvious parameter reads without it would leave the back door open.
What it costs
Three families of scanner check cannot run. GovIntel publishes which.