Four tickets from the market team. Each identity should be able to read reports-41xsq, and the deployer role should be assumable by admin. None of them can. Read before you fix:

aws s3 cp s3://reports-41xsq/report.csv - --profile dana
aws s3 cp s3://reports-41xsq/report.csv - --profile lee
aws s3 ls --profile kim
aws sts assume-role --role-arn arn:aws:iam::123456789012:role/deployer --role-session-name test

1. dana has a policy that lists the bucket but cannot read objects: a missing action.
2. lee has a policy that reads the wrong bucket: a wrong resource.
3. kim is in a group with read access and a Deny nobody remembers writing.
4. deployer is a role whose trust policy names a service, not a person.

Fix each with the smallest change. simulate-principal-policy tells you when you are done, and AdministratorAccess is not an answer.