Amazon S3 Now Shows Exact Policy ARN in Access Denied Errors
Amazon S3 just got smarter about telling you what went wrong—HTTP 403 errors now include the specific IAM or Organizations policy ARN that blocked your request, so you can skip the detective work and fix it straight away. This works for same-account and same-organization requests across all AWS Regions, including GovCloud and China, covering SCPs, RCPs, identity-based policies, session policies, and permission boundaries.
source: [aws/whats-new]