title: AWS policy evaluation
body: <p>I have an IAM role to be attached to a microservice in order to limit S3 folder access based on user-agent. The microservice parent account and the bucket owner are the same.</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "s3:*"
              ],
              "Resource": [
                  "arn:aws:s3:::bucket-test/service/${aws:useragent}/*"
              ]
          },
          {
              "Sid": "AllowListingOfUserFolder",
              "Action": [
                  "s3:ListBucket"
              ],
              "Effect": "Allow",
              "Resource": [
                  "arn:aws:s3:::bucket-test"
              ],
              "Condition": {
                  "StringLike": {
                      "s3:prefix": [
                          "service/${aws:useragent}/*"
                      ]
                  }
              }
          }
      ]
  }
  </code></pre>
  
  <p>The same S3 bucket has a default ACL where the account has R/W on objects and permissions.</p>
  
  <p>Given the ACL and the IAM policy, I don't understand how this policy evaluates. For example, a user with the above role makes a <code>put_object</code> request to <code>bucket-test/service/micro-b/new_object</code> with user agent <code>micro-a</code>. Is this an explicit or implicit deny? Why?</p>