DynamoDB Block Public Access toggle and resource-based policy interaction

DynamoDB supports resource-based policies that allow administrators to define access permissions directly on a table. When a policy uses a wildcard principal ("*"), the table may be exposed to public access.

The AWS Management Console provides a Block Public Access toggle designed to mitigate accidental exposure. However, there is uncertainty regarding the functional scope of this toggle when interacting with resource-based policies versus identity-based IAM policies.

Specifically, it is unclear if the Block Public Access setting acts as a guardrail that overrides existing resource-based allow statements or if it merely serves as a notification mechanism.

• Does the Block Public Access toggle actively block requests from anonymous principals if a resource-based policy explicitly allows "*"?
• What is the documented precedence between the Block Public Access setting and a resource-based policy granting public access?