A security engineer created an Amazon S3 bucket policy with an explicit deny that blocks access for all users. A few days later, the engineer added a new statement to allow read-only access for a specific employee. The employee still receives Access Denied. What is the most likely reason?

AWS IAM policies operate on an "explicit deny overrides explicit allow" principle. If a policy contains an explicit deny for a particular action or resource, that deny will always take precedence, even if other policies explicitly allow the action. In this scenario, the initial bucket policy with an explicit deny for all users will override the later added allow statement for the specific employee, resulting in continued "Access Denied" errors. The bucket ACL is less granular and typically superseded by bucket policies for access control. While the user's IAM policy is important, the bucket policy is evaluated first for resource-based permissions. Policy propagation is usually very fast and unlikely to be the cause after "a few days.