Ciao Amici 👋
Let me start with a confession. Every time I hit an AccessDenied in AWS, I do the same lazy thing you do. I copy the wall of text, paste it into a chat model, and ask "why?".
And every time, I get back a tidy little list of maybes. Maybe it is your identity policy. Maybe it is an SCP. Maybe a permissions boundary. Maybe a resource policy. All plausible. All confident. None of them actually checked against my account.
That bothered me for a long time. The model was not lying to me exactly. It was doing the only thing it could do with the words I gave it. But "here are five things it might be" is not an answer. It is a starting point for an afternoon of clicking through the IAM console.
So I built a tool that stops guessing and starts checking. It is called Rosetta, and this post is the full story of building it, including the bug I found in my own ranking logic and the Bedrock wall I walked straight into.
