When something can't access something else in AWS:
- Who is the principal? EC2 instance role? Lambda role? IAM user? IRSA service account?
- What does the identity policy allow? Check effective permissions including group memberships and SCPs.
- Does the resource have a resource-based policy? S3 bucket policy, KMS key policy, etc. Both identity and resource policies must allow.
- Is there a permissions boundary? If set, it caps the maximum permissions.
- Is there an explicit deny anywhere? Explicit denies always win.
- Is this cross-account? Both the trust policy on the role AND the permissions on the calling identity must allow.
- CloudTrail — the access-denied event tells you exactly which principal tried which action on which resource and which policy denied it.