IAM policy issue with Healthlake - bug with not existing but required action
AWS have a bug with policies. To reproduce:
- Create datastore in Healthlake
- Create a user which will have limited access to Healthlake
- Attach to it Read and Write permissions (for datastore)
- Try to call validation on resource (https://docs.aws.amazon.com/healthlake/latest/devguide/reference-fhir-operations-validate.html) - you will get
Exception: HealthLake error 403: {“Message”:“User: arn:aws:iam::<USER>:user/YYYY is not authorized to perform: healthlake:ValidateResource on resource: arn:aws:healthlake:us-east-1:<ARN>:datastore/fhir/WWWWWWWWWW because no identity-based policy allows the healthlake:ValidateResource action”}
- Go to IAM Roles or Polices and try add or create policy:
healthlake:ValidateResourceyou are unable to do it <- such not exists in IAM
If you have some CI/CD with auto creation in Terraform/CDK you are also unable to add it without manually created JSON
Your application code is attempting to call healthlake:ValidateResource, but this action doesn't exist in the AWS HealthLake API.
To workaround, you need to edit JSON policy manually, add this action and save - with error showing on screen
I think AWS forgot to add that policy to the list :D
- Newest
- Most votes
- Most comments
This appears to be an issue with the AWS HealthLake service where the healthlake:ValidateResource action is required to perform validation operations on FHIR resources, but this action is not available in the standard IAM policy editor.
When you try to use the visual editor in IAM to add this permission, you're unable to find it because it's not included in the list of recognized actions for HealthLake. However, the API is expecting this permission to be present in your policy for the validation operation to work.
To resolve this issue, you'll need to manually edit the JSON policy document directly rather than using the visual editor. Even though the IAM console may show an error when you try to save a policy with this "unknown" action, the policy will still work correctly when applied.
Here's how to fix it:
- Go to the IAM console
- Edit the policy attached to your user or role
- Switch to the JSON editor view
- Add the
healthlake:ValidateResourceaction to the appropriate statement in your policy - Save the policy despite any warnings that may appear
This is a workaround until AWS updates their IAM service to recognize this action as a valid HealthLake permission.
If you're using infrastructure as code tools like Terraform or AWS CDK, you'll need to define the policy using JSON format directly rather than using higher-level constructs that validate the action names against the AWS service models.
Sources
Troubleshooting AWS HealthLake identity and access - AWS HealthLake
How do I troubleshoot when User: arn is no authorized to perform Create * or Delete * or Update * on resource(s) because no identity- policy allows the actions | AWS re:Post
