Translate AWS AccessDenied into Instant Fixes

Paste a raw AWS CLI, Boto3, or CloudWatch error trace to diagnose the root cause and generate a verified least-privilege IAM policy.