How does AWS Identity and Access Management $($IAM$)$ evaluate a policy? An explicit deny statement does not override an explicit allow statement. It checks for explicit deny statements before it checks for explicit allow statements. It checks for explicit allow statements before it checks for explicit deny statements. If the policy doesn't have any explicit deny statements or explicit allow statements, users have access by default.