sam, lee and kim all try to read reports-1dxtw40 and all fail. Read each denial:

aws s3 ls s3://reports-1dxtw40 --profile sam
aws s3 ls s3://reports-1dxtw40 --profile lee
aws s3 ls s3://reports-1dxtw40 --profile kim

Trace each one: list-groups-for-user, list-attached-user-policies, get-group-policy, get-policy-version. Then confirm with the simulator before you change anything:

aws iam simulate-principal-policy --policy-source-arn arn:aws:iam::123456789012:user/sam --action-names s3:ListBucket --resource-arns arn:aws:s3:::reports-1dxtw40

Kim's policy has a typo and lee's group carries a Deny that nobody meant. Fix both; leave sam as he is, he has no business in that bucket.