policy access to CUR and Data Exports

I have a single account with a single IAM policy giving " * " access to cur and bcm-data-exports and their associated S3 bucket. When trying to access cur, I get an odd error noting "Unauthorized_User_Description_IAM_Enabled" which I can't find anywhere... When I move to the 'new' interface, I get more information, citing an explicit deny for each service (one error for cur and one for bcm-data-exports) - but I only have a single user, with a single policy. Organizations is not being used. The user account could access cur and run reports yesterday.