diff --git a/rustfs/src/error.rs b/rustfs/src/error.rs
index e5a243630..e7826bbac 100644
--- a/rustfs/src/error.rs
+++ b/rustfs/src/error.rs
@@ -33,6 +33,16 @@ impl std::fmt::Display for ApiError {
 impl std::error::Error for ApiError {}
 
 impl ApiError {
+    /// Access-denied error with the exact message emitted by the authorization
+    /// paths in `storage::access`; callers there match on the code only.
+    pub fn access_denied() -> Self {
+        ApiError {
+            code: S3ErrorCode::AccessDenied,
+            message: "Access Denied".to_string(),
+            source: None,
+        }
+    }
+
     pub fn other<E>(error: E) -> Self
     where
         E: std::fmt::Display + Into<Box<dyn std::error::Error + Send + Sync>>,
diff --git a/rustfs/src/storage/access.rs b/rustfs/src/storage/access.rs
index 4b4674869..b86c208e2 100644
--- a/rustfs/src/storage/access.rs
+++ b/rustfs/src/storage/access.rs
@@ -859,7 +859,7 @@ pub async fn authorize_request<T>(req: &mut S3Request<T>, action: Action) -> S3R
         }
 
         if action == Action::S3Action(S3Action::ListAllMyBucketsAction) {
-            return Err(s3_error!(AccessDenied, "Access Denied"));
+            return Err(ApiError::access_denied().into());
         }
 
         let policy_allowed_fallback = PolicySys::try_is_allowed(&BucketPolicyArgs {