If you receive something like this as a result of an aws operation:
You are not authorized to perform this operation. Encoded authorization failure message: (redacted)
Then, you can decode it like this:
aws sts decode-authorization-message --encoded-message redacted
To have the above command work, make sure your user has the sts:DecodeAuthorizationMessage grant.