DynamoDB export to s3 access denied

The issue you're experiencing with exporting your DynamoDB table to S3 is likely related to permissions, despite having admin access. Here are some potential causes and solutions to consider:

1. Block Public Access settings: Check if the S3 bucket has Block Public Access enabled at the bucket or account level. This setting can override other permissions and cause access denied errors. You may need to adjust these settings if they're restricting access.

2. AWS Organizations Service Control Policies (SCPs): If your AWS account is part of an organization, there might be SCPs in place that are explicitly denying certain actions, even for admin users. Review any applicable SCPs to ensure they're not blocking S3 access.

3. Encryption settings: If the S3 bucket is using AWS Key Management Service (KMS) for encryption, ensure that your IAM role has the necessary permissions to use the KMS key. You may need to update the KMS key policy to allow access for your IAM entity.

4. Cross-account access: If the DynamoDB table and S3 bucket are in different AWS accounts, make sure you have the correct cross-account permissions set up.

5. VPC endpoint policies: If you're using VPC endpoints, check that the endpoint policies allow the necessary S3 actions.

To troubleshoot:

1. Double-check your IAM permissions, ensuring there are no explicit deny statements for S3 actions.

2. Review the S3 bucket configuration, including any bucket policies, ACLs, or encryption settings that might be affecting access.

3. Use AWS CloudTrail to investigate the API calls being made during the export process. This can help identify where exactly the permission is being denied.

4. Try creating a new IAM role specifically for the DynamoDB export process with the necessary permissions, and use that role for the export operation.

If the issue persists after checking these areas, you may need to contact AWS Support for further assistance in identifying any account-level restrictions or hidden policy conflicts.
Sources
Resolve access issues when you export from DynamoDB to Amazon S3 | AWS re:Post
Troubleshoot access denied (403 Forbidden) errors in Amazon S3 - Amazon Simple Storage Service
Troubleshoot 403 Access Denied error in Amazon S3 | AWS re:Post

The error message says that the failure was caused by "an explicit deny in an identity-based policy." That means it wasn't denied by a statement in a bucket policy, a missing allow statement for using a KMS key in an identity-based policy, etc., but specifically by a policy statement with the "Deny" effect that is defined in an identity-based policy. Even when full access is allowed, statements with the "Deny" effect specified in any policy that applies to a request will overrule all "allows" specified in all applicable policies.

I suggest you first check in the AWS IAM console which "permissions policies" are attached to the role "AWSReservedSSO_AdministratorAccess_85217d97fd694e48". Most likely, you'll find a policy statement with the "Deny" effect that blocks this action. If you can't find any "deny" statements in the policies attached to the role, then check in the same IAM console if a "permissions boundary" is specified for the role. If so, check if "deny" statement is specified there.

Once you find the "deny" statement, you can see the exact resources and conditions that have to match for the "deny" effect to be applied. For example, such a "deny" might be defined to block certain operations when the request is not coming from a trusted IP address range, such as from the company's public IP address ranges or dedicated Privileged Access Workstation environment.