Status: IN
In CloudTrail advanced event selectors, DESELECT operators (NotEquals, NotStartsWith, NotEndsWith) are AND'd and take precedence over SELECT operators (Equals, StartsWith, EndsWith) which are OR'd.
Source: entries/2026/03/12/awscloudtrail-latest-userguide-filtering-data-eventshtml.md