AWS S3 access denied to actual object when simulator says access is allowed

Question

I have a user, I'll call Alfred User, with attached IAM policy as follows

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket-name/*",
                "arn:aws:s3:::my-bucket-name/",
                "arn:aws:s3:::my-bucket-name"
            ]
        }
    ]
}

In the IAM simulator, I get "Allowed" for GetObject, using this policy, and this ARN: arn:aws:s3:::my-bucket-name/my-object.xml

On the CLI, I get AccessDenied for the following command: aws s3 cp s3://my-bucket-name/my-object.xml temp/my-object.xml

A client error (AccessDenied) occurred when calling the GetObject operation: Access Denied

I've looked at everything I can think of but I can't explain this discrepancy. What am I missing?

Things I've tried

"creds" here mean "AWS IAM access keys"

• IAM simulator -- this works
• A different set of IAM creds -- this works
• Using aws s3 ls s3://my-bucket-name/ -- this works with Alfred's IAM creds and with my creds
• Compared policies to a similarly configured bucket in a different AWS account. The policies are identical, near as I can tell.

Answer 1

Turns out it was permissions on the KMS key(s) that encrypt this bucket. The keys are owned by the root account, and as such I couldn't find them with my normal IAM access, nor could I see the policy on them.