When evaluating access to the topic, a combination of all policies is going to be considered for each individual accessing the topic. If a user, group, or role does not have permission to access SNS, the service will implicitly deny all access. But once access to SNS is allowed, a combination of the IAM SNS policy and the topic's own access policy will be applied. Be careful when setting explicit denies in either the IAM policy or the access policy, as any explicit denies will of course override any explicit allows, thereby potentially causing valid actions to be unavailable.