Logs when the policy is denying access?

Question

Related to https://repost.aws/questions/QUukCQO7PLQceXJiDRjqxBbg/iam-resources-requires-region-and-account-id I had an incorrect policy that was accidentally denyting access to write to cloudwatch logs.

I could not see any indication that my policy was wrong or (failed) attempted accesses from **Access Advisor**. Is that to be expected?

Or is there some way to detect these security events in Cloudtrail?

Answer

Hi hendry,

You can see Deny events in CloudTrail. In the [this document](https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/) you can see the different ways to troubleshoot IAM permission problems, including a AWS CLI command to filter these events from AWS CloudTrail.

Logs when the policy is denying access?

Relevant content