diff --git a/crates/notify/src/rules/xml_config.rs b/crates/notify/src/rules/xml_config.rs
index fd6a344e4..680ee8774 100644
--- a/crates/notify/src/rules/xml_config.rs
+++ b/crates/notify/src/rules/xml_config.rs
@@ -207,7 +207,7 @@ impl<'de> Deserialize<'de> for S3KeyFilter {
                             self.filter_rules = s3key_content.get_filter_rules();
                         }
                         _ => {
-                            map.next_value::<serde::de::IgnoredAny>()?;
+                            return Err(serde::de::Error::unknown_field(&key, &["S3Key"]));
                         }
                     }
                 }
diff --git a/crates/policy/src/policy/policy.rs b/crates/policy/src/policy/policy.rs
index 0929b9642..56a9c816c 100644
--- a/crates/policy/src/policy/policy.rs
+++ b/crates/policy/src/policy/policy.rs
@@ -55,6 +55,7 @@ impl Args<'_> {
 }
 
 #[derive(Serialize, Deserialize, Clone, Default, Debug)]
+#[serde(deny_unknown_fields)]
 pub struct Policy {
     #[serde(default, rename = "ID")]
     pub id: ID,
@@ -192,6 +193,7 @@ pub struct BucketPolicyArgs<'a> {
 /// Bucket Policy with AWS S3-compatible JSON serialization.
 /// Empty optional fields are omitted from output to match AWS format.
 #[derive(Serialize, Deserialize, Clone, Default, Debug)]
+#[serde(deny_unknown_fields)]
 pub struct BucketPolicy {
     #[serde(default, rename = "Id", skip_serializing_if = "ID::is_empty")]
     pub id: ID,
diff --git a/crates/policy/src/policy/principal.rs b/crates/policy/src/policy/principal.rs
index adfa0f510..639ef71f0 100644
--- a/crates/policy/src/policy/principal.rs
+++ b/crates/policy/src/policy/principal.rs
@@ -68,6 +68,7 @@ enum PrincipalFormat {
 }
 
 #[derive(serde::Deserialize)]
+#[serde(deny_unknown_fields)]
 struct PrincipalObject {
     #[serde(rename = "AWS", default)]
     aws: Option<PrincipalValues>,
diff --git a/crates/policy/src/policy/statement.rs b/crates/policy/src/policy/statement.rs
index 6bea77cc8..c5c52f3a3 100644
--- a/crates/policy/src/policy/statement.rs
+++ b/crates/policy/src/policy/statement.rs
@@ -22,6 +22,7 @@ use crate::error::{Error, Result};
 use serde::{Deserialize, Serialize};
 
 #[derive(Serialize, Deserialize, Clone, Default, Debug)]
+#[serde(deny_unknown_fields)]
 pub struct Statement {
     #[serde(rename = "Sid", default)]
     pub sid: ID,
@@ -284,7 +285,7 @@ impl PartialEq for Statement {
 /// Bucket Policy Statement with AWS S3-compatible JSON serialization.
 /// Empty optional fields are omitted from output to match AWS format.
 #[derive(Debug, Deserialize, Serialize, Default, Clone)]
-#[serde(rename_all = "PascalCase", default)]
+#[serde(rename_all = "PascalCase", default, deny_unknown_fields)]
 pub struct BPStatement {
     #[serde(rename = "Sid", default, skip_serializing_if = "ID::is_empty")]
     pub sid: ID,