A role has two identity policies attached. Policy 1 allows s3:* on arn:aws:s3:::uploads/*. Policy 2 denies s3:DeleteObject on the same resource. The service calls DeleteObject on a key in uploads. What happens?

The delete is denied, because an explicit deny always wins. IAM checks all the policies that apply, together. An explicit deny anywhere overrides every allow. If no policy allows an action, it is denied by default. This is an implicit deny.

The order of policies does not matter, and how specific they are does not matter. So "The delete succeeds because s3:* is more general than the deny" is wrong: the broad s3:* allow cannot beat a deny. "The policy attached first wins" is wrong for the same reason. "The request fails validation" is also wrong: policies that conflict are valid, and IAM just applies the deny.