Access denied to delete objects in s3 bucket

The bucket policy I shared below can be deleted by anyone in the AWS account who has permission to do so.
https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-bucket-user-policy-specifying-principal-intro.html#s3-aws-account-permissions

{ 
    "Version": "2012-10-17", 
    "Id": "Policy1689496022829", 
    "Statement": [ 
        { 
            "Sid": "Stmt1689495997312", 
            "Effect": "Allow", 
            "Principal": { 
                "AWS": "arn:aws:iam::250422108324:root" 
            }, 
            "Action": "s3:*", 
            "Resource": [ 
                "arn:aws:s3:::skindex-facet/*", 
                "arn:aws:s3:::skindex-facet" 
            ] 
        } 
    ] 
}

In addition, S3 buckets that are no longer accessible to anyone can be edited by logging in as the AWS root user to edit the bucket policy.
https://repost.aws/knowledge-center/s3-accidentally-denied-access

Can you share your current IAM user policies and the bucket policies set for your S3 buckets?
If all permissions are fine with the IAM user, try deleting the S3 bucket policy and deleting the object.
Also, have you set up SCP in AWS Organizations, etc.?
If SCP is configured, also make sure that deleteObject is allowed in SCP.

In the previous answer, Riku rightly mentioned that IAM identity, bucket policy and SCP are three things which you should check.

Explicit deny error comes because of restrictions in one or more of the following type of policies:

1. Identity-based policies
2. Resource-based policies
3. Permissions boundary
4. Service control policies
5. Session policy

Since this is for DeleteObject, there would be restriction either through Resource based policy(bucket policy), SCP, Permission Boundary, Session Policy. Can you paste cloudtrail API call detail for access denied error after redacting your account/resource information.

Also, check if there is any SCP attached to this account by going to organization->policies->scp-> see policy content and it's attached target. Explicit deny most commonly appears because of deny either at SCP or permissions boundary, which doesn't come into notice immediately.

When you add allow for Deleteobject access in bucket policy(as suggested above), make sure that there is no deny condition for same action.

Hope you find this helpful.

So here's what you should do when looking into this. If you're getting access denied within S3, there's multiple areas to check. Here's a few that I can think of off the top of my head. To do this, let's try start very simple and work towards more complexity as we move on.

1. Validate the IAM policy with the role/user you are logged in with. In some cases these can get crazy confusing if you have NotAction, etc... Validate you do have permissions via the policy first.
2. Check the bucket policy to validate there is no blocks there. Be aware that assigning permissions at a bucket policy level does NOT grant a user/role the ability to do an action. They still need the policy as IAM is evaluated first.
3. Make sure you have no organization blocks
4. Open the bucket, go to an object in question and go to permissions, make sure the owner is your account. If it's another account, then you won't have access to it and it'll need to be deleted by the other account.
5. Checked the object to see if it has object lock on it. You can do this by going to the properties of the object. If this is enabled, then again you'll need to remove this before you can delete the object
6. Check if the object has KMS encryption enabled. If it does, you'll need permissions to the KMS key via IAM and via the KMS policy (this one is overlooked a lot in my time troubleshooting customer S3 issues)

There's probably a few areas I'm forgetting, but these are a few spots to check to help you move forward and should solve the issue.