I have a question
let’s assume I attached IAM policy "EC2FullAccess" to a user
and then I added that specific user to a group
but that group don’t have "EC2FullAccess" Policy
is he will still able to access to EC2?
>Solution :
No, one doesn’t take precedence over the other. They are "combined". The user would have all the permissions applied to the group, plus all the permissions applied to their individual account.
The exception is a Deny statement in a policy, which always takes precedence over any Allow statement.