diff --git a/crates/s3/src/select.rs b/crates/s3/src/select.rs
index e0eba48..a752244 100644
--- a/crates/s3/src/select.rs
+++ b/crates/s3/src/select.rs
@@ -197,6 +197,9 @@ fn classify_aws_code_missing_metadata(text: &str) -> Error {
     if text.contains("NoSuchBucket") {
         return Error::NotFound("Bucket not found".to_string());
     }
+    if text.contains("AccessDenied") {
+        return Error::Auth("Access denied".to_string());
+    }
     Error::General(text.to_string())
 }
 
@@ -231,6 +234,12 @@ mod tests {
         assert!(matches!(e, Error::NotFound(msg) if msg.contains("Bucket")));
     }
 
+    #[test]
+    fn classify_missing_code_maps_access_denied_substring() {
+        let e = classify_aws_code(None, "Service error: ... AccessDenied ...");
+        assert!(matches!(e, Error::Auth(msg) if msg.contains("Access denied")));
+    }
+
     #[test]
     fn classify_maps_invalid_argument() {
         let e = classify_aws_code(Some("InvalidArgument"), "bad expr");