AccessDenied Error for IAM OIDC Provider in New AWS Account

Question

Hello,

I am experiencing an "AccessDenied" error when attempting to interact with an OpenID Connect (OIDC) provider in my newly created AWS account and user (with AdministratorAccess policy). The specific error occurs when I try to access the OIDC provider using either the AWS CLI or through Terraform. Below are the details of the issue:

Error message:

│ Error: reading IAM OIDC Provider (arn:aws:iam::xxxxxxxx:oidc-provider/oidc.eks.eu-west-1.amazonaws.com/id/yyyyyy): operation error IAM: GetOpenIDConnectProvider, https response error StatusCode: 403, RequestID: cbdb93f6-aea9-471e-b792-529744839fd6, api error AccessDenied: User: arn:aws:iam::xxxxxxx:user/xxxxx-2 is not authorized to access this resource
│
│   with module.eks.aws_iam_openid_connect_provider.oidc_provider[0],
│   on .terraform/modules/eks/main.tf line 351, in resource "aws_iam_openid_connect_provider" "oidc_provider":
│  351: resource "aws_iam_openid_connect_provider" "oidc_provider" {
│

I have verified that the user is attached to the AdministratorAccess policy, and I have also tried generating a new access key to ensure permissions are up-to-date. Despite this, the user is still receiving the "AccessDenied" error when trying to access the OIDC provider.

Here are the steps I have already taken to troubleshoot:

Verified that AdministratorAccess is correctly attached to the user.
Tested permissions using AWS CLI and Terraform, but both return the same "AccessDenied" error.
Used aws sts get-caller-identity to confirm that the correct user is being used, and the correct permissions are in place.
Ensured that my account is not part of an AWS organization, so SCPs should not be restricting my permissions.

I would appreciate your assistance in understanding why this issue is occurring and any guidance on how to resolve it. If any additional permissions are required or if there are restrictions on newly created accounts, please let me know.

Thank you in advance for your help.

Best regards,

re:Post Agent · Answer

The issue you're experiencing with the "AccessDenied" error when trying to interact with an OpenID Connect (OIDC) provider in your new AWS account, despite having AdministratorAccess policy, is unusual and requires further investigation.

Given that you've already verified the AdministratorAccess policy is correctly attached to your user and confirmed the correct user is being used, the problem might be related to one of the following:

1. Time delay: In some cases, there can be a slight delay between when permissions are granted and when they become fully effective across all AWS services. Although this is typically a matter of minutes, you might want to wait a bit longer and try again.

2. OIDC provider not created: If the OIDC provider hasn't been created yet in your account, attempting to access it will result in an AccessDenied error. Ensure that the OIDC provider has been properly created before trying to interact with it.

3. Region mismatch: Verify that you're operating in the correct AWS region where the OIDC provider was created.

4. Account limits: New AWS accounts sometimes have certain limitations or restrictions that are gradually lifted over time. While this typically doesn't affect IAM operations, it's worth considering.

5. Service-linked role: Ensure that the necessary service-linked role for IAM OIDC operations exists in your account. This role is usually created automatically, but in rare cases, it might not be present.

To troubleshoot further:

1. Try creating a new OIDC provider manually using the AWS Management Console or AWS CLI to see if you encounter the same error.

2. Check your AWS account's health dashboard for any ongoing issues that might affect IAM or OIDC operations.

3. If possible, test with another administrator user in the same account to determine if the issue is specific to your user or affects all users.

4. Review the IAM Access Analyzer findings for any potential issues related to your OIDC provider or IAM permissions.

If the problem persists after trying these steps, it would be advisable to contact AWS Support for further assistance. They can provide more detailed insights into your specific account configuration and any potential restrictions or issues that might be causing this unexpected behavior.  
**Sources**  
[Create an OpenID Connect (OIDC) identity provider in IAM - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html)  
[AddClientIDToOpenIDConnectProvider - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/APIReference/API_AddClientIDToOpenIDConnectProvider.html)  
[get-open-id-connect-provider — AWS CLI 2.18.5 Command Reference](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-open-id-connect-provider.html)

AccessDenied Error for IAM OIDC Provider in New AWS Account

Add your answer

Relevant content