IAM Policy Evaluation

Decide whether specific calls are permitted by a set of IAM policies, following IAM evaluation order: an explicit Deny wins over every Allow, and the absence of an Allow is a denial because there is no implicit allow. A request allowed or denied only under a Condition is reported as undetermined rather than decided, because the condition depends on a request context that is not supplied. A NotAction or NotResource statement is named as not evaluated rather than silently skipped.