The policy that allowed everything and granted nothing
A platform team attached an organization-level policy to an account allowing storage and compute actions, expecting the developer role in that account to gain access.
Every call is denied. The role has no policy of its own — and the thing they attached can only ever narrow what's possible, never confer it.
Attach the policy that actually grants the permission.
Components — tap one, then tap a slot on the diagram
!Every call returns access denied — and the policy they attached clearly allows it.
Boundaries, outermost first: Member account: Developer role (FAILED: denied), Storage bucket, Org policy (a ceiling, not a grant), an empty slot for the the actual grant Connections: Org policy controls Developer role — caps what's possible the actual grant calls Developer role — grants (step 1) Developer role calls Storage bucket (step 2)
Developer roledenied
Storage bucket
Org policya ceiling, not a grant