Troubleshoot access denied error messages - AWS Identity and Access Management
I get "access denied" when I make a request to an AWS serviceI get "access denied" when I make a request with temporary security credentialsAccess TroubleshooterAccess denied examples

Troubleshoot access denied error messages

The following information can help you identify, diagnose, and resolve access denied errors with AWS Identity and Access Management. Access denied errors appear when AWS explicitly or implicitly denies an authorization request.

  • An explicit denial occurs when a policy contains a Deny statement for the specific AWS action.

  • An implicit denial occurs when there is no applicable Deny statement and also no applicable Allow statement. Because an IAM policy denies an IAM principal by default, the policy must explicitly allow the principal to perform an action. Otherwise, the policy implicitly denies access. For more information, see The difference between explicit and implicit denies.

When you make a request to a service or resource, multiple policies may apply to the request. Review all applicable policies in addition to the policy specified in the error message.

  • If multiple policies of the same policy type deny a request, the access denied error message doesn't specify the number of policies evaluated.

  • If multiple policy types deny an authorization request, AWS includes only one of those policy types in the error message.

Important

Having trouble signing in to AWS? Make sure that you're on the correct AWS sign-in page for your type of user. If you are the AWS account root user (account owner), you can sign in to AWS using the credentials that you set up when you created the AWS account. If you are an IAM user, your account administrator can give you AWS sign-in credentials. If you need to request support, do not use the feedback link on this page. The form is received by the AWS Documentation team, not Support. Instead, on the Contact Us page choose Still unable to log into your AWS account and then choose one of the available support options.

I get "access denied" when I make a request to an AWS service

  • Check if the error message includes the type and Amazon Resource Name (ARN) of the policy responsible for denying access. If this is the case, then check for deny statements for the action in the specified policy. If the policy type is provided but there is no policy ARN, then focus on troubleshooting issues for that policy type: Check for deny statements for the action in policies of the specified type. If the error message doesn't mention the policy type responsible for denying access, use the rest of the guidelines in this section to troubleshoot further.

  • Verify that you have the identity-based policy permission to call the action and resource that you have requested. If any conditions are set, you must also meet those conditions when you send the request. For information about viewing or modifying policies for an IAM user, group, or role, see Manage IAM policies.

  • If the AWS Management Console returns a message stating that you're not authorized to perform an action, then you must contact your administrator for assistance. Your administrator provided you with your sign-in credentials or sign-in link.

    The following example error occurs when the mateojackson IAM user attempts to use the console to view details about a fictional my-example-widget resource but does not have the fictional widgets:GetWidget permissions.

    User: arn:aws:iam::123456789012:user/mateojackson is not authorized to perform: widgets:GetWidget on resource: my-example-widget

    In this case, Mateo must ask his administrator to update his policies to allow access to the my-example-widget resource using the widgets:GetWidget action.

  • Are you trying to access a service that supports resource-based policies, such as Amazon S3, Amazon SNS, or Amazon SQS? If so, verify that the policy specifies you as a principal and grants you access. If you make a request to a service within your account, either your identity-based policies or the resource-based policies can grant you permission. If you make a request to a service in a different account, then both your identity-based policies and the resource-based policies must grant you permission. To view the services that support resource-based policies, see AWS services that work with IAM.

  • If your policy includes a condition with a key–value pair, review it carefully. Examples include the aws:RequestTag/tag-key global condition key, the AWS KMS kms:EncryptionContext:encryption_context_key, and the ResourceTag/tag-key condition key supported by multiple services. Make sure that the key name does not match multiple results. Because condition key names are not case sensitive, a condition that checks for a key named foo matches foo, Foo, or FOO. If your request includes multiple key–value pairs with key names that differ only by case, then your access might be unexpectedly denied. For more information, see IAM JSON policy elements: Condition.

  • If you have a permissions boundary, verify that the policy that is used for the permissions boundary allows your request. If your identity-based policies allow the request, but your permissions boundary does not, then the request is denied. A permissions boundary controls the maximum permissions that an IAM principal (user or role) can have. Resource-based policies are not limited by permissions boundaries. Permissions boundaries are not common. For more information about how AWS evaluates policies, see Policy evaluation logic.

  • If you are signing requests manually (without using the AWS SDKs), verify that you have correctly signed the request.

  • If you're using an Amazon VPC endpoint policy and you get an access denied error that is not logged in AWS CloudTrail, it might be because the VPC endpoint owner account is different from the calling account or target role account.

I get "access denied" when I make a request with temporary security credentials

  • First, make sure that you are not denied access for a reason that is unrelated to your temporary credentials. For more information, see I get "access denied" when I make a request to an AWS service.

  • Verify that the service accepts temporary security credentials, see AWS services that work with IAM.

  • Verify that your requests are being signed correctly and that the request is well-formed. For details, see your toolkit documentation or Use temporary credentials with AWS resources.

  • Verify that your temporary security credentials haven't expired. For more information, see Temporary security credentials in IAM.

  • Verify that the IAM user or role has the correct permissions. Permissions for temporary security credentials are derived from an IAM user or role. As a result, the permissions are limited to those that are granted to the role whose temporary credentials you have assumed. For more information about how permissions for temporary security credentials are determined, see Permissions for temporary security credentials.

  • If you assumed a role, your role session might be limited by session policies. When you request temporary security credentials programmatically using AWS STS, you can optionally pass inline or managed session policies. Session policies are advanced policies that you pass as a parameter when you programmatically create a temporary credential session for a role. You can pass a single JSON inline session policy document using the Policy parameter. You can use the PolicyArns parameter to specify up to 10 managed session policies. The resulting session's permissions are the intersection of the role's identity-based policies and the session policies. Alternatively, if your administrator or a custom program provides you with temporary credentials, they might have included a session policy to limit your access.

  • If you are an AWS STS federated user principal, your session might be limited by session policies. You create a federated user session by signing in to AWS as an IAM user and then requesting a federation token. For more information, see Requesting credentials through a custom identity broker. If you or your identity broker passed session policies while requesting a federation token, then your session is limited by those policies. The resulting session's permissions are the intersection of your IAM user identity-based policies and the session policies. For more information about session policies, see Session policies.

  • If you are accessing a resource that has a resource-based policy by using a role, verify that the policy grants permissions to the role. For example, the following policy allows MyRole from account 111122223333 to access amzn-s3-demo-bucket.

    JSON
    {
  "Version":"2012-10-17",		 	 	 
  "Statement": [{
    "Sid": "S3BucketPolicy",
    "Effect": "Allow",
    "Principal": {"AWS": ["arn:aws:iam::111122223333:role/MyRole"]},
    "Action": ["s3:PutObject"],
    "Resource": ["arn:aws:s3:::amzn-s3-demo-bucket/*"]
  }]
}

Access Troubleshooter

Note

Access Troubleshooter is gradually becoming available for all AWS services in all regions for single account and single organization scenarios. The richness of data will evolve.

You can use Access Troubleshooter to debug and resolve access denied errors.

Access Troubleshooter provides the following capabilities:

Permissions for Access Troubleshooter

To use Access Troubleshooter, you must have iam:TroubleshootAccess permission attached to your principal. Allowing this action means you are allowing the principal to view all authorization context details, including the context keys and statements of all policies that were evaluated.

The following example policy grants the necessary permission:

{
    "Version": "2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "iam:TroubleshootAccess",
            "Resource": "*"
        }
    ]
}

Using Access Troubleshooter

When you receive an access denied error, the error message includes a link and an AuthorizationID that you can use with Access Troubleshooter. The following example shows an access denied error message:

An error occurred (AccessDenied) when calling the RestoreTableFromBackup operation: User: arn:aws:sts:012345678901:assumedRole/DatabaseDev/RestoreBackupSession is not authorized to perform: dynamodb:RestoreTableFromBackup with an explicit deny in an identity policy. Go to https://console.aws.amazon.com/iam/home#/access-troubleshooter for complete details, or call the iam:GetAuthorizationDetails API with the following authorization id: 67f1576b-af29-4c66-9b2b-10fd67516713

If you have the appropriate permission, on the console you can choose Troubleshoot in IAM to open a new Access Troubleshooter tab.

Alternatively, you can call the iam:GetAuthorizationDetails API using the AuthorizationID:

aws iam get-authorization-details --authorization-id 67f1576b-af29-4c66-9b2b-10fd67516713

If you are an administrator and a developer provides the AuthorizationID, you can go to the IAM console and enter the AuthorizationID to retrieve the authorization context details.

View the request and evaluation details

Access Troubleshooter provides your request details that were considered in the evaluation. You can review the operation or API call you attempted, the Authorization ID, the principal making the call, the resource you tried to access, and the evaluation result.

View individual authorization evaluation

To successfully call an operation, you might need additional permissions to perform dependent actions. For example, to perform RestoreTableFromBackup on DynamoDB, you need permissions for dynamodb:BatchWriteItem, dynamodb:DeleteItem, dynamodb:GetItem, dynamodb:PutItem, dynamodb:Query, dynamodb:Scan, and dynamodb:UpdateItem. These actions are evaluated against the resources you want to access. For more information, see the Service Authorization Reference.

Review all policies and their individual statements

In many cases, multiple policies affect your authorization, and each policy can contain multiple statements. Access Troubleshooter lists all policies that are evaluated when you perform your operation. You can review the individual statements within those policies and the evaluation result for each, giving you a complete view to resolve issues efficiently.

Access denied error message examples

Most access denied error messages appear in the format User user is not authorized to perform action on resource because context. In this example, user is the ARN of the principal that is denied access, action is the service action that the policy denies, and resource is the ARN of the resource on which the policy acts. The context field provides additional context about the policy type that denied access. In some cases, it also contains the ARN of the policy which denied access.

When a policy explicitly denies access because the policy contains a Deny statement, then AWS includes the phrase with an explicit deny in a type policy in the access denied error message. This phrase may also specify the ARN of the policy, as follows: with an explicit deny in a type policy: policy ARN.

When the policy implicitly denies access, then AWS includes the phrase because no type policy allows the action action in the access denied error message.

Note

Some AWS services do not support this access denied error message format. The content of access denied error messages can vary depending on the service making the authorization request.

The following examples show the format for different types of access denied error messages.

Access denied due to a service control policy – implicit denial

  1. Check for a missing Allow statement for the action in your service control policies (SCPs). For the following example, the action is codecommit:ListRepositories.

  2. Update your SCP by adding the Allow statement. For more information, see Updating an SCP in the AWS Organizations User Guide.

User: arn:aws:iam::123456789012:user/John is not authorized to perform: codecommit:ListRepositories
because no service control policy allows the codecommit:ListRespositories action

Access denied due to a service control policy – explicit denial

  1. If a policy ARN is provided in the error message, check for a Deny statement for the action in the specified service control policy (SCP). In the example below, the action is codecommit:ListRepositories.

  2. If no policy ARN is provided in the error message, check for a Deny statement for the action in your SCPs.

  3. Update your SCP by removing the Deny statement. For more information, see Update a service control policy (SCP) in the AWS Organizations User Guide.

Error message with a policy ARN:

User: arn:aws:iam::123456789012:user/John is not authorized to perform: codecommit:ListRepositories
with an explicit deny in a service control policy: arn:aws:organizations::777788889999:policy/o-exampleorgid/service_control_policy/p-examplepolicyid123

Error message without a policy ARN:

User: arn:aws:iam::123456789012:user/John is not authorized to perform: codecommit:ListRepositories
with an explicit deny in a service control policy

Access denied due to a resource control policy – explicit denial

  1. If a policy ARN is provided in the error message, check for a Deny statement for the action in the specified resource control policy (RCP). In the example below, the action is secretsmanager:GetSecretValue.

  2. If no policy ARN is provided in the error message, check for a Deny statement for the action in your RCPs.

  3. Update your RCP by removing the Deny statement. For more information, see Update a resource control policy (RCP) in the AWS Organizations User Guide.

Error message with a policy ARN:

User: arn:aws:iam::123456789012:user/John is not authorized to perform: secretsmanager:GetSecretValue
on resource: arn:aws:secretsmanager:us-east-1:123456789012:secret:*
with an explicit deny in a resource control policy: arn:aws:organizations::777788889999:policy/o-exampleorgid/resource_control_policy/p-examplepolicyid456

Error message without a policy ARN:

User: arn:aws:iam::123456789012:user/John is not authorized to perform: secretsmanager:GetSecretValue
on resource: arn:aws:secretsmanager:us-east-1:123456789012:secret:*
with an explicit deny in a resource control policy

Access denied due to a VPC endpoint policy – implicit denial

  1. Check for a missing Allow statement for the action in your Virtual Private Cloud (VPC) endpoint policies. For the following example, the action is codecommit:ListRepositories.

  2. Update your VPC endpoint policy by adding the Allow statement. For more information, see Update a VPC endpoint policy in the AWS PrivateLink Guide.

User: arn:aws:iam::123456789012:user/John is not authorized to perform: codecommit:ListRepositories
because no VPC endpoint policy allows the codecommit:ListRepositories action

Access denied due to a VPC endpoint policy – explicit denial

  1. Check for an explicit Deny statement for the action in your Virtual Private Cloud (VPC) endpoint policies. For the following example, the action is codedeploy:ListDeployments.

  2. Update your VPC endpoint policy by removing the Deny statement. For more information, see Update a VPC endpoint policy in the AWS PrivateLink Guide.

User: arn:aws:iam::123456789012:user/John is not authorized to perform: codedeploy:ListDeployments
on resource: arn:aws:codedeploy:us-east-1:123456789012:deploymentgroup:*
with an explicit deny in a VPC endpoint policy

Access denied due to a permissions boundary – implicit denial

  1. Check for a missing Allow statement for the action in your permissions boundary. For the following example, the action is codedeploy:ListDeployments.

  2. Update your permissions boundary by adding the Allow statement to your IAM policy. For more information, see Permissions boundaries for IAM entities and Edit IAM policies.

User: arn:aws:iam::123456789012:user/John is not authorized to perform: codedeploy:ListDeployments
on resource: arn:aws:codedeploy:us-east-1:123456789012:deploymentgroup:*
because no permissions boundary allows the codedeploy:ListDeployments action

Access denied due to a permissions boundary – explicit denial

  1. If a policy ARN is provided in the error message, check for a Deny statement for the action in the specified permissions boundary. In the example below, the action is sagemaker:ListModels.

  2. If no policy ARN is provided in the error message, check for a Deny statement for the action in the permissions boundary attached to the principal.

  3. Update your permissions boundary by removing the Deny statement from your IAM policy. For more information, see Permissions boundaries for IAM entities and Edit IAM policies.

Error message with a policy ARN:

User: arn:aws:iam::123456789012:user/John is not authorized to perform: sagemaker:ListModels
with an explicit deny in a permissions boundary: arn:aws:iam::123456789012:policy/DeveloperPermissionBoundary

Error message without a policy ARN:

User: arn:aws:iam::123456789012:user/John is not authorized to perform: sagemaker:ListModels
with an explicit deny in a permissions boundary

Access denied due to session policies – implicit denial

  1. Check for a missing Allow statement for the action in your session policies. For the following example, the action is codecommit:ListRepositories.

  2. Update your session policy by adding the Allow statement. For more information, see Session policies and Edit IAM policies.

User: arn:aws:iam::123456789012:user/John is not authorized to perform: codecommit:ListRepositories
because no session policy allows the codecommit:ListRepositories action

Access denied due to session policies – explicit denial

  1. If a policy ARN is provided in the error message, check for a Deny statement for the action in the specified session policy. In the example below, the action is codedeploy:ListDeployments.

  2. If no policy ARN is provided in the error message, check for a Deny statement for the action in your session policies.

  3. Update your session policy by removing the Deny statement. For more information, see Session policies and Edit IAM policies.

Error message with a policy ARN:

User: arn:aws:iam::123456789012:user/John is not authorized to perform: codedeploy:ListDeployments
on resource: arn:aws:codedeploy:us-east-1:123456789012:deploymentgroup:*
with an explicit deny in a session policy: arn:aws:iam::123456789012:policy/DeveloperSessionPolicy

Error message without a policy ARN:

User: arn:aws:iam::123456789012:user/John is not authorized to perform: codedeploy:ListDeployments
on resource: arn:aws:codedeploy:us-east-1:123456789012:deploymentgroup:*
with an explicit deny in a session policy

Access denied due to resource-based policies – implicit denial

  1. Check for a missing Allow statement for the action in your resource-based policy. For the following example, the action is secretsmanager:GetSecretValue.

  2. Update your policy by adding the Allow statement. For more information, see Resource-based policies and Edit IAM policies.

User: arn:aws:iam::123456789012:user/John is not authorized to perform: secretsmanager:GetSecretValue
because no resource-based policy allows the secretsmanager:GetSecretValue action

Access denied due to resource-based policies – explicit denial

  1. Check for an explicit Deny statement for the action in your resource-based policy. For the following example, the action is secretsmanager:GetSecretValue.

  2. Update your policy by removing the Deny statement. For more information, see Resource-based policies and Edit IAM policies.

User: arn:aws:iam::123456789012:user/John is not authorized to perform: secretsmanager:GetSecretValue
on resource: arn:aws:secretsmanager:us-east-1:123456789012:secret:*
with an explicit deny in a resource-based policy

Access denied due to role trust policies – implicit denial

  1. Check for a missing Allow statement for the action in your role trust policy. For the following example, the action is sts:AssumeRole.

  2. Update your policy by adding the Allow statement. For more information, see Resource-based policies and Edit IAM policies.

User: arn:aws:iam::123456789012:user/John is not authorized to perform: sts:AssumeRole
because no role trust policy allows the sts:AssumeRole action

Access denied due to role trust policies – explicit denial

  1. Check for an explicit Deny statement for the action in your role trust policy. For the following example, the action is sts:AssumeRole.

  2. Update your policy by removing the Deny statement. For more information, see Resource-based policies and Edit IAM policies.

User: arn:aws:iam::123456789012:user/John is not authorized to perform: sts:AssumeRole
with an explicit deny in the role trust policy

Access denied due to identity-based policies – implicit denial

  1. Check for a missing Allow statement for the action in identity-based policies attached to the identity. For the following example, the action is codecommit:ListRepositories attached to the role HR.

  2. Update your policy by adding the Allow statement. For more information, see Identity-based policies and Edit IAM policies.

User: arn:aws:iam::123456789012:role/HR is not authorized to perform: codecommit:ListRepositories
because no identity-based policy allows the codecommit:ListRepositories action

Access is denied due to identity-based policies – explicit denial

  1. If a policy ARN is provided in the error message, check for a Deny statement for the action in the specified policy. In the example below, the action is codedeploy:ListDeployments.

  2. If no policy ARN is provided in the error message, check for a Deny statement for the action in identity-based policies attached to the identity.

  3. Update your policy by removing the Deny statement. For more information, see Identity-based policies and Edit IAM policies.

Error message with a policy ARN:

User: arn:aws:iam::123456789012:role/HR is not authorized to perform: codedeploy:ListDeployments
on resource: arn:aws:codedeploy:us-east-1:123456789012:deploymentgroup:*
with an explicit deny in an identity-based policy: arn:aws:iam::123456789012:policy/HRAccessPolicy

Error message without a policy ARN:

User: arn:aws:iam::123456789012:role/HR is not authorized to perform: codedeploy:ListDeployments
on resource: arn:aws:codedeploy:us-east-1:123456789012:deploymentgroup:*
with an explicit deny in an identity-based policy