Fix AWS S3 403 Access Denied

S3 evaluates several policy layers. A deny in any one of them blocks the request:

• IAM identity policy on the caller.
• Bucket policy.
• Object ACL and Object Ownership setting.
• Block Public Access at the account or bucket level.
• KMS key policy when the object is SSE-KMS encrypted.
• VPC endpoint policy if accessed via a Gateway endpoint.

Simulate the call

aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123:user/me \
  --action-names s3:GetObject \
  --resource-arns arn:aws:s3:::my-bucket/key

Grant minimum IAM permission

{
  "Effect": "Allow",
  "Action": ["s3:GetObject"],
  "Resource": "arn:aws:s3:::my-bucket/*"
}

Don't forget KMS

If the object is encrypted with a customer KMS key, the caller also needs `kms:Decrypt` on the key.