AWS First Steps
New feature

Amazon S3 adds detailed policy information to access denied error messages

Amazon S3 now shows specific IAM and organization policy ARNs in access denied errors, helping users quickly identify and resolve policy issues

Amazon S3 now includes the specific ARN of the AWS IAM and AWS Organizations policy in HTTP 403 Access Denied error messages for requests within the same account or organization. This allows users to quickly identify the exact policy causing a denied request and address the issue directly. Previously, error messages only indicated the policy type and reason for denial, requiring manual inspection of multiple policies of the same type to find the root cause. The update now displays the specific policy ARN for explicit deny cases, covering Service Control Policies, Resource Control Policies, identity-based policies, session policies, and permission boundaries. This feature is available in all AWS Regions, including AWS GovCloud (US) and AWS China Regions.

Why it matters

This change benefits users managing access control policies for Amazon S3 and those troubleshooting access denied issues

Read the original AWS announcement

Related articles and terms

IAM Policy Evaluation Logic Explained - How Implicit Deny Loses to Explicit AllowA step-by-step explanation of how IAM evaluates requests to allow or deny them, covering the priority of implicit deny, explicit allow, and explicit deny, as well as intersection logic for SCPs, permission boundaries, and session policies.Designing Identity and Access Management - Achieving Zero Trust Security with IAMLearn access management design techniques with AWS IAM, including the principle of least privilege, policy design, and achieving zero trust security through Cognito integration.AWS IAM Fine-Grained Access Control - How Policy-Based Design Achieves the Principle of Least PrivilegeExplore the design philosophy behind AWS IAM's policy-based access control and compare its granularity with Azure RBAC and GCP IAM in concrete terms.IAM Access AnalyzerA service that automatically analyzes resource policies on S3 buckets, IAM roles, and more to detect external access and unused permissions, strengthening your security postureFine-Grained Authorization with Amazon Verified Permissions - Access Control Using Cedar PoliciesLearn how to externalize authorization logic from application code using the Cedar policy language and implement token-based authorization decisions with Cognito integration.