How do I troubleshoot SCP explicit deny errors in AWS Organizations?

Short description

You can use Organizations Service control policies (SCPs) to manage permissions for member accounts in your organization. However, SCPs don't grant permissions to AWS Identity and Access Management (IAM) identities in your organization.

To grant access to an API action, both the SCP and the IAM identity-based policy must allow access for the member account.

Resolution

To confirm that the explicit deny error occurred because an SCP denied the request, use the AWS CloudTrail Event history to search for the event name. Then, from the AWS Organizations management account use the Organizations console to either remove or modify the policy to allow the API action request.

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

Review the CloudTrail Event history

Use the CloudTrail console

You can view all supported services and integrations and event types, such as create, modify, delete, and non-mutable activities, from the past 90 days. You don't need to set up a trail to use CloudTrail Event history.

For instructions, see Viewing recent CloudTrail events in the CloudTrail console.

Use the AWS CLI

Run the lookup-events AWS CLI command to look up management events or CloudTrail Insights events for the past 90 days.

Run the filter-log-events command to apply metric filters to search for specific terms, phrases, and values in your log events. You can then change them to CloudWatch metrics and alarms.

For more information, see Filter pattern syntax for metric filters, subscription filters, filter log events, and Live Tail.

Use the AWS Organizations console to remove or modify the SCP

Complete the following steps:

1. Open the AWS Organizations console with your AWS Organization management account.
2. In the navigation pane, choose AWS accounts, and then choose the affected member account.
3. Choose the Policies tab, and then review all applied SCPs that restrict access to API actions.
4. To edit the policy, select the SCP, choose Edit policy. After you edit the policy, choose Save changes.
   -or-
   To delete the policy, select the SCP, and then choose Delete
   -or-
   To detach the policy, select the SCP, and then choose Detach.

Use the AWS CLI to manage Service Control Policies

Retrieve policy details

To describe the policy and review it's current configuration and content, run the following describe-policy AWS CLI command:

aws organizations describe-policy --policy-id policy-id

Note: Replace policy-id with your policy ID.

The preceding command returns the policy's metadata, which includes the name, description, type, and the complete JSON policy document.

Identify attached targets

To determine which organizational units (OUs) or accounts are affected by the policy, run the following list-targets-for-policy AWS CLI command:

aws organizations list-targets-for-policy --policy-id policy-id

Note: Replace policy-id with your policy ID.

The preceding command lists all targets where the policy is currently attached. This helps assess the scope of impact before you make changes.

Update the policy

To modify the policy, run the following update-policy AWS CLI command with the updated JSON policy document:

aws organizations update-policy --policy-id policy-id --content "Updated JSON"

Note: Replace policy-id with your policy ID and Updated JSON with your updated policy document.

Confirm the JSON content is properly escaped and formatted. For complex policies, store the JSON in a file and use the file:// prefix:

aws organizations update-policy --policy-id policy-id --content file://updated-policy.json

Note: Replace policy-id with your policy ID and updated-policy.json with your policy document file.

Detach or delete the policy

If you need to remove the policy entirely rather than modify it, then complete the following steps:

1. To detach the policy from a specific target, run the following detach-policy command:

   aws organizations detach-policy --policy-id policy-id --target-id target-id

   Note: Replace policy-id with your policy ID and target-id with your target ID.

2. To delete the policy after detaching it from all targets, run the following delete-policy command:

   aws organizations delete-policy --policy-id policy-id

   Note: Replace policy-id with your policy ID.

Verify the explicit deny error is resolved

From the member account, run the API action again to confirm that the explicit deny error is resolved.

Related information

Service control policies (SCPs)

Enhanced access denied error messages with policy ARNs

Viewing details of an organization from the management account