I ran into this problem here:

• datasette.simonwillison.net simonwillisonblog#273 (comment)

If you use --policy but forget to set --user-permissions-boundary=none you are likely to generate credentials that can't be used, because they only work with S3.