We’ve set up AWS IAM Identity Center for our team. People can sign in through the access portal and select the right account, but some AWS CLI commands still return AccessDenied.

I’m trying to narrow down whether the issue is usually the permission set, an account-level policy, or how the CLI profile was configured. What do you check first when console access works but command-line access does not? We have several accounts and would like to avoid handing out broader permissions just to make the errors disappear.