AWS S3 access denied despite correct IAM policy

S3 operations fail with AccessDenied even though the IAM policy grants the correct permissions. The policy looks correct in the console.

Check all of these: (1) Bucket policy: may explicitly deny access (Deny overrides Allow). (2) S3 Block Public Access: enabled at account or bucket level. (3) Wrong account: the bucket is in a different AWS account. (4) Policy conditions: IP restrictions, VPC endpoint, MFA. (5) STS assumed role: check the effective permissions of the assumed role. (6) Object-level ACLs: the object may have restrictive ACLs. (7) KMS key: if objects are encrypted with CMK, need kms:Decrypt permission. (8) Policy simulator: IAM console > Policy Simulator to test.

S3 access control has multiple layers: IAM policies, bucket policies, ACLs, Block Public Access, and encryption key policies. Access requires ALL layers to permit it.