mei and tomas both have the policy InvoicesRead attached. Both can list invoices-186q1z8, and neither can download an invoice. Both have profiles.

1. Try to download the invoice as mei, and read which resource the error names:

   sh

   copy

   aws s3 cp s3://invoices-186q1z8/2026-09.csv 2026-09.csv --profile mei

2. Find the policy attached to mei:

   sh

   copy

   aws iam list-attached-user-policies --user-name mei

3. Read the policy's current version and compare its read statement with the resource from step 1.

4. Fix the policy itself, so that the fix reaches everyone it is attached to. Then try the download again, as mei and as tomas.