Status: IN
IAM policy evaluation order: explicit deny overrides all > SCP/RCP/permissions boundary/session policy implicit deny > explicit allow in identity-based or resource-based policy > default deny (all requests start denied).
Source: entries/2026/03/11/IAM-latest-UserGuide-intro-structurehtml.md