Administrators befuddled by AWS access-denied messages will welcome a new open-source tool announced Thursday by cloud infrastructure security company Ermetic.