Do we have evaluation order for AWS IAM? - amazon-web-services

Question

I am trying to find out one problem with IAM policy of one of my user.
I have policy which says deny access if the service is not in our list. I am trying to grant access to my user for all action of apigateway. I have provided below policy. But it is denying access for all action other than GET, OPTIONS, HEAD. I have the wild character * in the beginning, will be individual actions override the wild character settings. I am trying to understand the evaluation order for IAM. Does the individual action override the *?
{
"Statement": [
{
"Resource": "*",
"Effect": "Deny",
"NotAction": [
"apigateway:*"
"apigateway:GET",
"apigateway:OPTIONS",
"apigateway:HEAD"
]
}
]
}

Answer 1

In AWS IAM, all requests are denied by default. So, you only need to grant permissions to the desired actions while all other actions will be denied by default.
When a request is made, the AWS service decides whether a given
request should be allowed or denied. The evaluation logic follows
these rules:
By default, all requests are denied. (In general, requests made using the account credentials for resources in the account are always allowed.)
An explicit allow overrides this default.
An explicit deny overrides any allows.
The order in which the policies are evaluated has no effect on the outcome of the evaluation. All policies are evaluated, and the result is always that the request is either allowed or denied.
See Determining Whether a Request is Allowed or Denied.
So, usually it should be enough to write your Allow policy as:
{
"Statement": [
{
"Resource": "*",
"Effect": "Allow",
"Action": [
"apigateway:GET",
"apigateway:OPTIONS",
"apigateway:HEAD"
]
}
]
}
However, if you suspect that other policies might be granting the user undesired actions, you could write your Deny policy as:
{
"Statement": [
{
"Resource": "*",
"Effect": "Deny",
"NotAction": [
"apigateway:GET",
"apigateway:OPTIONS",
"apigateway:HEAD"
]
}
]
}

Answer 2

This line was helpful from the AWS docs:
An explicit deny in any policy overrides any allows