An S3 endpoint policy permits a bucket, but the application role has an explicit deny for that bucket. What is the result?

1. The endpoint policy grants access regardless of all identity policies.
2. Moving the endpoint to another subnet cancels the role deny.
3. Private routing automatically bypasses S3 authorization.
4. Access remains denied; the endpoint policy does not override the explicit IAM deny.