S3 403 errors named the denying policy ARN from 13 August 2026, but bucket and VPC endpoint policies are excluded
AWS added the denying policy ARN to S3 403 messages on 13 August 2026. It appears only on explicit deny, covers five policy types, and skips bucket policies, VPC endpoint policies and directory buckets.
