In one sentence
The account owns resources and billing, identity says who is accessing, session stores the current login, Region / AZ locates resources, and policy controls allowed actions.
Visibility layers
| Layer | Question |
|---|---|
| Account | Which account owns the resource? |
| Identity | Which principal is making the request? |
| Session | Which login context is in this window? |
| Region / AZ | Where is the resource located? |
| Permission | Does the principal have List, Describe, Get, or other required actions? |
A volume created by an administrator belongs to the account and target Region / AZ, not privately to that IAM user. Each later API action is evaluated again.
Troubleshooting order
Check the 12-digit account ID, current identity, selected Region, List / Describe permissions, console filters and resource state, then whether the resource scope is global, regional, or zonal.
Multi-session only keeps login contexts in parallel. It creates no account, copies no resources, merges no permissions, and changes no ownership.