title: Why Doesn't My AWS S3 Bucket Policy Override My IAM Policy?
body: <p>I have a user in my IAM account called "testuser" who has administrator privileges, like so:</p>
  
  <pre><code>{
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "*",
        "Resource": "*"
      }
    ]
  }
  </code></pre>
  
  <p>And then I have a policy on my S3 bucket that denies this user access, like so:</p>
  
  <pre><code>{
    "Statement": [
      {
    "Effect": "Deny",
    "Principal": {
      "AWS": "my-account-id:user/testuser"
    },
    "Action": "s3:*",
    "Resource": "arn:aws:s3:::my-bucket-name/*"
      }
    ]
  }
  </code></pre>
  
  <p>So, the explicit deny in the S3 bucket policy should override the allow from the IAM policy right?  But when I log in as testuser, I still have access to everything in that bucket - I even have access to change or remove the bucket policy for that bucket (and every other bucket too).  Why isn't my explicit deny doing anything?</p>