IAM and KMS Across the Hybrid Lab–Cloud Boundary
Transfer logs said AccessDenied. The bucket policy “allowed S3.” Someone added s3:* on the role and it still failed—because the objects used SSE-KMS and the key policy never trusted the transfer identity.
Read More