@feld Yeah. I remember spending more than a day years ago, trying to create a policy for a user account to have access to a specific file in S3, and even w/ help from people who knew AWS, I could not for the life of me create a policy that would work. Part of the problem was that despite me having delegated access to the resource, there isn't anyway for me to see what permission failures happened to debug the issue (you can if you have root, etc).