AWS IAM permission denied — debugging access issues

AWS API calls fail with AccessDenied or UnauthorizedAccess. The IAM policy looks correct but the operation is still denied. CloudTrail shows the request was denied.

(1) Check identity: aws sts get-caller-identity — are you using the right role/user? (2) Policy ordering: explicit Deny always wins over Allow. Check for SCPs, permission boundaries, and resource policies that may deny. (3) Use IAM Policy Simulator to test policies. (4) Check condition keys: some policies restrict by IP, time, MFA, or tags. (5) Resource-based policies (S3 bucket policy, KMS key policy) may not grant access to your principal. (6) For cross-account: both accounts must grant access. (7) Enable CloudTrail and check the errorMessage field for the specific reason.

AWS IAM considers multiple policy types: SCPs, resource policies, identity policies, and permission boundaries. A deny at any level overrides allows at other levels.