Enhanced access denied error messages with policy ARNs

This article announces enhanced access denied error messages that now include the Amazon Resource Name (ARN) of the denying policy, improving troubleshooting capabilities.

• Policy ARNs now included in access denied error messages for IAM and AWS Organizations policies
• Covers service control policies, resource control policies, permissions boundaries, session policies, and identity-based policies
• Limited to same-account and same-organization scenarios for security
• Only policy ARN is revealed, not the full policy document or permissions
• Eliminates need to review all policies of same type to identify the culprit
• Accelerates troubleshooting and improves cross-team communication with specific policy reference
• Rolling out gradually across all AWS services and regions starting early 2026

This enhancement streamlines access denied error troubleshooting by providing the exact policy ARN causing denial, reducing investigation time and improving security validation.