Previously, S3 access denied errors identified policy types but left ambiguity when multiple policies of the same type applied. The new error messages include explicit Amazon Resource Names (ARNs) for the denied policies, aiding precise identification of the root cause across identity or service control policies within the same account or organization.
This capability covers explicit deny scenarios for various AWS policy types and is deployed globally, including GovCloud and China regions. It facilitates faster remediation by enabling administrators to pinpoint the exact policy in conflict without manually reviewing all potentially involved policies.
Source & further reading
Amazon S3 adds additional policy details to access denied error messages ↗Source published 2026-08-13. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.