How can I resolve access denied issues caused by permissions boundaries?

Short description

AWS Identity and Access Management (IAM) returns access denied or unauthorized errors when your policy doesn't meet specific condition requirements.

To resolve the issue, identify the specific IAM user or IAM role that causes the problem. Review the permissions boundary attached to that entity. A permissions boundary allows you to use a managed policy to set maximum permissions for an IAM entity. This feature controls the maximum permissions that an identity-based policy can grant to an IAM user or role. When you set a permissions boundary for an entity, that entity can only perform actions that both policies allow.

Note: An entity can only perform actions that both the identity-based policy and the permissions boundary allow.

Resolution

If permissions boundaries don't resolve the error, then review the service control policies (SCPs) in your AWS account. Next, check if any resource-based policies contain denies for the IAM entity.

Check if an action is allowed in your IAM policy, but not in the permissions boundary

The following example shows an action that is allowed in an IAM policy, but not in the permissions boundary. In this example, an IAM user has the policy USER_IAM_POLICY attached to it:

IAM policy:(USER_IAM_POLICY)
 “Effect”: “Allow”,
            “Action”: [
                “ec2:*”,
                “s3:*”
            ],

This policy gives the user full access to Amazon Elastic Compute Cloud (Amazon EC2) and Amazon Simple Storage Service (Amazon S3) services. The user also has a permissions boundary named USER_PB_POLICY set.

Permissions Boundary:(USER_PB_POLICY)
 “Effect”: “Allow”,
            “Action”: [
                “cloudwatch:*”,
                “s3:*”
            ],

The permissions boundary sets the maximum permissions that the user can perform. In this example, this permission boundary allows full access to Amazon CloudWatch and Amazon S3 services. But, because Amazon S3 is the only service that is allowed in both the IAM policy and the permissions boundary, the user only has access to S3. If the user tries to access Amazon EC2, they receive an access denied error.

To resolve this error, edit the permissions boundary and allow access to Amazon EC2:

“Effect”: “Allow”,
            “Action”: [
                “cloudwatch:*”,
                “s3:*”,
                “ec2:*”
            ],

Include all required actions in the permissions boundary using the IAM console

To edit the permissions boundary to include all actions that a user requires, complete the following steps:

1. Open the IAM console.
2. In the navigation pane, choose Roles/Users.
3. Choose the IAM entity you want to edit.
4. In the Permissions boundary section, check your settings. If a permissions boundary is set, this means that there is a permissions boundary in place. The name of the managed policy that serves as a permissions boundary on your IAM entity is listed in this section.
5. Expand the JSON policy, and check if the action you require is allowed in the permissions boundary. If the permissions boundary doesn't allow your action, then edit the JSON policy to allow all actions that your IAM entity requires.

For more information on how to modify policies, Editing IAM policies.

Use the iam:PermissionsBoundary condition key in your IAM policies

Add the iam:PermissionsBoundary condition key to your IAM policies. This condition key checks that a specific policy is attached as a permissions boundary on an IAM entity.

The following example shows an IAM policy named RestrictedRegionpermissionsBoundary:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EC2RestrictRegion",
            "Effect": “Allow”,
            "Action": "ec2:*” 
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:RequestedRegion": [
                        "us-east-1"
                   ]
                }
            }
        }

Create a policy and attach it to a delegated admin who has the responsibility to create users. When you attach the following example policy to the admin, they can only create an IAM user when they attach the RestrictedRegionPermissionsBoundary policy to that user. If the admin tries to create an IAM user without attaching the policy, they receive an access denied error.

{
            "Sid": "CreateUser",
            "Effect": "Allow",
            "Action": [
                "iam:CreateUser"
            ],
            "Resource": "arn:aws:iam::444455556666:user/test1*",
            "Condition": {
                "StringEquals": {
                    "iam:PermissionsBoundary": "arn:aws:iam::444455556666:policy/RestrictedRegionPermissionsBoundary"
                }
            }

To set the IAM policy RestrictedRegionPermissionsBoundary as a permissions boundary when you create a new user, complete the following steps:

1. Open the IAM console.
2. In the navigation pane, choose Users, and then choose Add Users.
3. Enter the user name that you want to edit, choose AWS access type, and then choose next.
4. Expand the Set permissions boundary section, and choose Use a permissions boundary to control the maximum role permissions.
5. In the search field, enter RestrictedRegionPermissionsBoundary, and then choose the radio button for your policy.
6. Choose Next:Tags.
7. Review your settings and create a user.

Related information

Evaluating effective permissions with boundaries

AWSSupport-TroubleshootIAMAccessDeniedEvents