Q53: IAM Policy Evaluation Logic. - AWS Cloud Architecture

In Simple Words:

Starts with default Implicit Deny.
Evaluates all applicable policies.
If an Explicit Deny exists anywhere, the final decision is immediately DENIED (Explicit Deny overrides everything!).
If an Explicit Allow exists and no Deny, decision is ALLOWED.
Otherwise, remains Denied.

json

// Explicit Deny overriding all permissions outside corporate IP range:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyNonCorporateAccess",
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": { "NotIpAddress": { "aws:SourceIp": ["203.0.113.0/24"] } }
    }
  ]
}