Access trace
Why was this request denied?
Follow one request from Entra ID sign-in through federation, IAM policy evaluation, network path and TLS. Change any condition to see which layer stops it and why.
The request: a member of the platform team reads an object from a private S3 bucket.
Allow
- IdentityEntra ID SSO
User signed in through the central identity provider.
- IdentityConditional Access
MFA satisfied on a managed device.
- FederationSAML role mapping
Group claim maps to a short-lived role session.
- AWS IAMExplicit deny
No Deny statement matched.
- AWS IAMService control policy
The organization permits this action.
- AWS IAMAllow decision
Both the identity policy and the permissions boundary allow it.
- NetworkPrivate path
Reached over a VPC endpoint.
- TransportTLS 1.2+
Encrypted in transit with an accepted protocol version.
How the model works
Checks run in order, and the first failure is the answer. The IAM section follows the documented order for a same-account request: explicit deny, SCP, resource policy, then boundary and identity policy.
What it leaves out
- Same-account only. Cross-account access needs an allow on both sides.
- Session policies, condition keys and resource control policies are left out.
Covers
- Entra ID
- SSO
- IAM evaluation
- Network controls
- TLS