AWS Access Denied: 7 Policy Layers and a 60-Second Fix

Since January 2026, AWS names the exact policy ARN that blocked you. 7-layer evaluation order, STS decode command, and a debugging flowchart.