Explicit deny

Also written: Deny

A policy statement with "Effect": "Deny" that matches a request. It beats every Allow, even an admin's s3:*.