Haven’t a chance to test, but I didn’t realise that “Deny” at the Group level don’t override “Allow” permissions at other levels (e.g. User) https://t.co/yTJkyjGXvF
Just another reason NOT to use #AWS IAM Users. If you have to, make them assume a role ASAP…