AWS IAM Access Denied Policy Debugger

How It Works

AWS IAM policy evaluation involves up to 6 layers of policies interacting.

Debugging "Access Denied" means checking all of them. This skill automates

the detective work.

What You Get

• Full policy chain trace for a given principal and action
• Identification of the denying policy (SCP, permission boundary, resource policy, or identity policy)
• Least-privilege policy generation from CloudTrail usage data
• Overpermission analysis for existing roles/users
• Policy simplification (consolidate overlapping statements)
• Plain-English explanation of what the policy allows and denies

Setup Steps

1. Provide the IAM principal (role, user), the action attempted, and the resource
2. Or paste the Access Denied error and the relevant policies
3. Review the diagnosis and apply the fix

Tips

• SCPs at the organization level are the most commonly missed blocker
• Permission boundaries are another sneaky deny source
• For least-privilege generation, you need CloudTrail logs of actual usage
• Ask your Claw to explain any policy in plain English — IAM JSON is hard to read
• Review service-linked roles — they have hidden permissions