What does it mean for a resource type to be required in an AWS IAM policy

Question

With reference to this page of the IAM documentation:

When does it matter that a resource type is required?

At first I thought that if a resource type is required and you specify the wildcard resource ("*") the statement won't apply. But I've tested that this is not the case (think of the implication on the star star managed Admin policy).

Then I thought that it might mean that some condition keys are only available when you qualify the arn up to or past a type, but I have found counter examples for that as well.

It gets stranger though, because some actions have multiple required resource types, and others still have multiple non-required resource types. Some have required resource types, but have condition keys listed next to no type.

I'm beginning to believe that the resource type column is of no practical use.

So when does it matter?

Answer 1

It matters for every policy. For example, if you are specifying permissions to take the action apigateway:Invoke and give a resource arn for a DynamoDB table, you won't get very far, for the resource type required is an execute api resource.