User is not is authorized to perform: aws-marketplace:Subscribe on resource: * with an explicit deny in a service control policy

Question

Hi,

i want to apply for accessing Bedrock Claude models but i get the error:
• Claude 3.5 Sonnet - User: arn:aws:sts:::assumed-role/AWSReservedSSO_AWSAdministratorAccess_ is not authorized to perform: aws-marketplace:Subscribe on resource: * with an explicit deny in a service control policy
• Claude 3 Sonnet - User: arn:aws:sts:::assumed-role/AWSReservedSSO_AWSAdministratorAccess_ is not authorized to perform: aws-marketplace:Subscribe on resource: * with an explicit deny in a service control policy
• Claude 3 Haiku - User: arn:aws:sts:::assumed-role/AWSReservedSSO_AWSAdministratorAccess_ is not authorized to perform: aws-marketplace:Subscribe on resource: * with an explicit deny in a service control policy
• Embed English - User: arn:aws:sts:::assumed-role/AWSReservedSSO_AWSAdministratorAccess_ is not authorized to perform: aws-marketplace:Subscribe on resource: * with an explicit deny in a service control policy
• Embed Multilingual - User: arn:aws:sts:::assumed-role/AWSReservedSSO_AWSAdministratorAccess_ is not authorized to perform: aws-marketplace:Subscribe on resource: * with an explicit deny in a service control policy

I know that i dont have the access rights, but how can i get them? Is this something my AWS admin of my company has to do or is ist an aws thing?

Thanks in advanced
Best Regards
Christoph

Riku_Kobayashi · Accepted Answer

Hello.

As stated in the error message, it looks like your SCP is explicitly set to deny "aws-marketplace:Subscribe".  
If you are not the organization administrator for the AWS account, you will need to ask an organization administrator to modify the SCP.  
Any changes to SCPs must be made in the AWS Organizations management account.  
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html

User is not is authorized to perform: aws-marketplace:Subscribe on resource: * with an explicit deny in a service control policy

回答を追加する

関連するコンテンツ