Developers use AWS CodeCommit with feature branches and pull requests to merge changes into the main branch. They must be prevented from pushing directly to the main branch. Developers were granted the AWSCodeCommitPowerUser managed policy, which currently allows direct pushes to main for every repository. How can the company prevent developers from pushing directly to the main branch?

The correct approach is to attach an additional IAM policy with an explicit Deny. IAM policies operate on an "explicit deny overrides explicit allow" principle. Even if AWSCodeCommitPowerUser allows GitPush and PutFile to all branches, an explicit Deny for these actions specifically targeting the main branch will prevent direct pushes. This policy should be scoped to the relevant repositories and use a condition to identify the main branch. Removing the existing policy and using AWSCodeCommitReadOnly would be overly restrictive, as developers need to push to feature branches. Editing the existing AWSCodeCommitPowerUser policy is not ideal because it's an AWS managed policy, which cannot be directly modified. Adding a policy that allows pushes only to feature branches would not override the existing AWSCodeCommitPowerUser policy's allowance for pushing to main.