IAM denies by default, any explicit Deny wins, and cross-account needs allows on both sides

The evaluation chain is fixed: start from an implicit deny; if any applicable policy contains an explicit Deny the request is denied and nothing else is consulted; otherwise an Allow must survive every applicable policy type, meaning service control policies and resource control policies at the organization level, permissions boundaries, session policies, identity-based policies and resource-based policies.

Within a single account, a resource-based policy that names the principal is by itself sufficient for most services even with no identity policy at all. Across accounts it is not: the identity policy in the caller's account and the resource policy in the resource's account must both allow the action. That asymmetry is the usual explanation for a cross-account S3 or KMS AccessDenied where the bucket policy is visibly correct.

When a denial is unexplained, run aws sts decode-authorization-message on the encoded message, or use the IAM policy simulator, which reports which policy type produced the decision.