After an IAM role policy change, municipal Lambda logs show AccessDenied on s3:GetObject for a known object key. What is the most likely root cause?
Select an answer to reveal the explanation.
Short Explanation
AccessDenied on a key you know exists usually means IAM said no after a policy change. Fix the role grant before you chase a phantom missing file.
Full Explanation
AccessDenied on s3:GetObject after a role policy change commonly means the execution role lost permission, even when the object key is valid. Authorization failures are a frequent integration root cause and should be verified in IAM before assuming object deletion. Route 53, Insights rewriting, and ElastiCache eviction do not produce this S3 authorization symptom.