I asked a very similar question here. I thought to add more clarity in this question.
As per AWS documentation,
NotPrincipal With Deny