Serverless Developer Guide
How policies are evaluated
For IAM principals, requests to AWS are implicitly denied. This means that if no policies are 
attached to a principal, IAM's default behavior is to deny access.
Next, if the principal does have an attached policy, and there is an explicit allow, the implicit deny 
is overridden. However, an explicit deny in any policy overrides any allows. In complex situations, 
there can be additional steps, but the following diagram represents this simpliﬁed model of how 
IAM evaluates identity based policies:
Warning
Identity based policies do not aﬀect the root user, so actions taken by the root user
account are implicitly allowed.
The root user is special in this regard and is the only principal that has this type of access.
Fundamentals 44