A newly created IAM user has no IAM policy attached. What will happen when the user logs in and attempts to view the AWS resources in the account?

AWS Identity and Access Management (IAM) operates on a principle of least privilege and an implicit deny model. When a new IAM user is created, it has no permissions associated with it by default. Without an attached IAM policy that explicitly allows actions (like ec2:DescribeInstances or s3:ListBuckets), all requests made by that user to view or interact with any AWS resource will be denied. Access must be explicitly granted.

A. This is incorrect. New users have no permissions by default, not even read-only access. All permissions, including read-only, must be explicitly granted.

C. This is incorrect. Access to billing information is highly sensitive and requires explicit permissions. It is not granted by default to new IAM users.

D. This is incorrect. The access method (AWS Management Console, CLI, or SDK) does not change the underlying permissions. If an action is denied, it is denied across all interfaces.

---

1. AWS IAM User Guide

"Overview of IAM": Under the section "How IAM works

" the documentation states: "When you create an IAM user

the user has no permissions. The user can't access AWS or perform any AWS actions." This directly supports the concept that a new user is denied access to all resources.

2. AWS IAM User Guide

"Policies and permissions in IAM": The section "Determining whether a request is allowed or denied within an account" explains the evaluation logic. It states

"By default

all requests are implicitly denied." For a new user with no policies

there is no Allow statement

so the final decision is an implicit deny.

3. AWS Well-Architected Framework

Security Pillar: The principle of least privilege is a core concept. The whitepaper states

"When you create IAM policies

you should grant only the permissions required to perform a task." This reinforces that permissions are not granted by default and must be deliberately assigned. (AWS Well-Architected Framework

Security Pillar

Page 15

"SEC 3: How do you manage identities for people and machines?").