SSO logged in to AWS CLI but cannot check my own Credentials

Question

I have created a new user in IAM Identity Centre, and I sso login to my account in aws cli via these steps:
[https://docs.aws.amazon.com/cdk/v2/guide/getting_started.html#getting_started_prerequisites]()

And my aws config file looks like this:

[default]

```
sso_session = my-sso
sso_account_id = [my numeric account id]
sso_role_name = AdministratorAccess
region = eu-west-2
output = json

[sso-session my-sso]
sso_region = eu-west-2
sso_start_url = [My AWS access portal URL]
sso_registration_scopes = sso:account:access
```

And when I want run an cli command:

```
`aws sts get-caller-identity`
```

it gave me the following error:

```
An error occurred (ForbiddenException) when calling the GetRoleCredentials operation: No access
```

I have set my assigned permission set AdministratorAccess to my account, so I don't know why the error appears. Please help.

Leo K · Answer

Alright, it's great that you got the blocker out of the way. Just to be sure something essential didn't get miscommunicated, if you entered an access key with an AWS_ACCESS_KEY_ID starting with **AKIA** in your credentials file or environment variables, that's a static access key attached either to an IAM user in exactly one AWS account or the root user of one AWS account. An AWS account is the item identified by a 12-digit number.

Another possibility is that you might have copied the access keys that IAM Identity Center gives when you log on and then click one of the names (like "AdministratorAccess") of the permission sets in one of the AWS accounts you have access to. Those keys would have an AWS_ACCESS_KEY_ID value starting with **ASIA**, which indicates that it's a temporary session key. Those keys are temporary and valid for between 1 and 12 hours, depending on the value configured for the permission set in IAM Identity Center's configuration.

I'm just pointing this out because you were configuring IAM Identity Center authentication initially, and users configured in IAM Identity Center or federated with it **do not have any permanent access keys,** only temporary ones. It's technically quite possible to configure temporary keys in the credentials file or to use them via environment variables, but they will stop working when the temporary keys expire, a maximum of 12 hours later.

If you're intending to use IAM Identity Center with its built-in user pool to authenticate, that's security-wise a good idea just because it does away with long-term access keys that are relatively easy to leak. But if you have keys with IDs starting with **AKIA**, those are not coming from IAM Identity Center, and they are static keys that can be leaked and used by anyone in the world, and in this case, presumably with full administrative control over at least one of your AWS accounts and possibly with the permission to assume roles in other accounts.

Leo K · Answer

Did you call `aws sso login` before `aws sts get-caller-identity`?

Leo K · Answer

Do you have the "AdministratorAccess" permission set assigned to the target account? It should have an IAM role with a name of the format "AWSReservedSSO_AdministratorAccess_hexadecimalid". Can you assume that role via the graphical user interface of IAM Identity Center and access the account via the regular AWS management console?

EXPERT

Leo K

answered 2 years ago

myronix88 · Answer

What do you see when you run `aws sso login`?

Isaac Behrens · Answer

Make sure that the role name is actually `AdministratorAccess`.  That is an AWS Managed Policy name but not a role unless you specifically created a role with that name.

HY · Answer

Yes I did. And the browser indicated that I logged in successfully.

HY · Answer

Thanks for all your help. I've got this resolved. Turns out I didn't get my access key properly set up. Once I did that it's all good.

HY · Answer

I'm sorry I'm a bit confused here. In this SSO sign in am I signing in to my IAM Identity Center account? Is it different from and AWS account?

I have set up a IAM Identity Center Account user(with AdminstratorAccess policy attached), and link my AWS account (also with AdminstratorAccess policy attached) to this Identity Center Account. I also created a role with AdmistratorAccess and attached it to my AWS account.

But I cannot attached any role to my IAM Identity Center account.

SSO logged in to AWS CLI but cannot check my own Credentials

Add your answer

Relevant content