Read the denial, name the gate

Six calls against the reports key failed overnight. Every one of them returned AccessDeniedException, so the error code tells you nothing on its own. The clause that follows it does.

Two gates decide a KMS call: the caller's own IAM policy, and the key policy attached to the key. Read each denial and sort it by the gate that closed. Two calls are refused by neither, so rotating the key would not help them either.