Al Mostakbal School: parents can no longer download report cards (“Access Denied”)

The Al Mostakbal School Group (a fictional private school in Fez) is publishing mid-term report cards tonight. Parents log in to parents.ecole-almostakbal.ma; the portal, hosted on ECS in a private subnet, reads the PDFs from the S3 bucket almostakbal-bulletins-prod with the IAM role almostakbal-portail-task.

Since publication at 17:00, every click on “Download the report card” returns “The document is temporarily unavailable”. The school switchboard is overwhelmed. Last Thursday, a contractor carried out a security audit of the buckets and “tightened access”.

You are the school's cloud administrator, on your workstation on the school network with the AWS CLI v2 (region eu-west-3, administrator profile).