AWS improved its Identity and Access Management (IAM) and Organizations error messages by appending Amazon Resource Names (ARNs) of policies causing access denials within the same account or organization. Previously, error messages only indicated the policy type without specifying which policy resulted in denied access, making root cause analysis more complex.
With this update, error messages disclose ARNs for Service Control Policies, Resource Control Policies, identity-based policies, session policies, and permission boundaries. The enhanced detail expedites troubleshooting by allowing customers to pinpoint exactly which policy is responsible for denial, simplifying permissions management in complex environments. This feature is rolling out gradually across AWS services and regions.
Source & further reading
AWS introduces additional policy details to access denied error messages ↗Source published 2026-01-21. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.