Resource Access Management:How do I troubleshoot an access denied error?

Identify the operator.

The Auth Subject parameter provides the details of the operator.

• Identity Type: the identity type of the operator, including RAM users, RAM roles, and single sign-on (SSO) identities. SSO is also known as identity federation.

• Identity Information: the identity. If the operator is a RAM user, the ID of the user is displayed. If the operator is a RAM role, the name and session name of the role are displayed, such as RoleName:RoleSessionName. If the operator is an SSO identity, the type and name of the IdP are displayed, such as saml-provider/AzureAD.

• Account ID: the ID of the Alibaba Cloud account to which the current identity belongs.

Identify the required permissions of the operator.

The Auth Action parameter provides the operation that the operator does not have permissions to perform. You can check or grant permissions based on the operation.

Identify the type of the policy that causes the access denied error.

The Policy Type parameter provides the type of the policy that causes the access denied error. The policy can be a control policy, session policy, role-specific trust policy (Assume Role Policy), or identity-based policy at the account or resource group level. For more information, see Policy evaluation process.

The method to adjust the policy varies based on the policy type.

• If the operation is denied based on a control policy, you must contact the management account of your resource directory to grant the required permissions. A control policy specifies the permissions that are granted to members in a resource directory. The decision of a control policy has a higher priority than the decision made within a single account.

• If the operation is denied based on a session policy, you must contact the account administrator to check the session policy that is attached to the operator by calling the AssumeRole operation.

• If the operation is denied based on a role-specific trust policy, you must contact the account administrator to check the trust policy of the RAM role that the operator assumes.

• If the operation is denied based on an identity-based policy, you must contact the account administrator to check the policy that is attached to the identity of the operator.

Check whether the cause of the access denied error is an implicit deny or explicit deny.

• Implicit deny: The error message indicates that you are not authorized to perform the current operation, and the Auth Determination parameter displays Insufficient Permissions. In this case, you must contact the account administrator to grant the required permissions. The account administrator can add the operation indicated by the Auth Action parameter to the Allow statement.

• Explicit deny: The error message indicates that the current operation is explicitly denied, and the Auth Determination parameter displays Explicit Deny. In this case, you must contact the account administrator to check the granted permissions and check whether the operation indicated by the Auth Action parameter is included in the Deny statement.

  Note

  If the policy is a control policy, Explicit Deny is returned even if the operation indicated by the Auth Action parameter is not included in the Allow statement.

Identify the operator.

• AuthPrincipalType: the identity type of the operator. SubUser indicates a RAM user, AssumedRoleUser indicates a RAM role, and Federated indicates an SSO identity.

• AuthPrincipalDisplayName: the identity. If the operator is a RAM user, the ID of the user is displayed. If the operator is a RAM role, the name and session name of the role are displayed, such as RoleName:RoleSessionName. If the operator is an SSO identity, the type and name of the IdP are displayed, such as saml-provider/AzureAD.

• AuthPrincipalOwnerId: the ID of the Alibaba Cloud account to which the current identity belongs.

Identify the required permissions of the operator.

The AuthAction field provides the operation that the operator does not have permissions to perform. You can check or grant permissions based on the operation.

Identify the type of the policy that causes the access denied error.

The PolicyType field provides the type of the policy that causes the access denied error. The policy can be a control policy, session policy, role-specific trust policy (Assume Role Policy), or identity-based policy at the account or resource group level. For more information, see Policy evaluation process.

The method to adjust the policy varies based on the policy type.

• If the operation is denied based on a control policy, you must contact the management account of your resource directory to grant the required permissions. A control policy specifies the permissions that are granted to members in a resource directory. The decision of a control policy has a higher priority than the decision made within a single account.

• If the operation is denied based on a session policy, you must contact the account administrator to check the session policy that is attached to the operator by calling the AssumeRole operation.

• If the operation is denied based on a role-specific trust policy, you must contact the account administrator to check the trust policy of the RAM role that the operator assumes.

• If the operation is denied based on an identity-based policy, you must contact the account administrator to check the policy that is attached to the identity of the operator.

Check whether the cause of the access denied error is an implicit deny or explicit deny.

• Implicit deny: The NoPermissionType field displays ImplicitDeny. In this case, you must contact the account administrator to grant the required permissions. The account administrator can add the operation indicated by the AuthAction field to the Allow statement.

• Explicit deny: The NoPermissionType field displays ExplicitDeny. In this case, you must contact the account administrator to check the granted permissions and check whether the operation indicated by the AuthAction field is included in the Deny statement.

  Note

  If the policy is a control policy, ExplicitDeny is returned even if the operation indicated by the AuthAction field is not included in the Allow statement.