An error occurred (AccessDeniedException) when calling the CreateDiskSnapshot operation
dongdongbh
asked 2 years ago

Question

Hi,

Got the above error when put core network policy.
Here is what I've checked:
* the role granted  admin permission for the troubleshoot
* the region is us-east-1, always active
* account managment api checked, no issue
* sts api checked, no issue
* tried different policies, even as simple as the following still got the above error:
"    cat > test-$version.json << EOF
{
  "version": "$version",
  "core-network-configuration": {
    "asn-ranges": ["64512-65534"],
    "edge-locations": [
      {
        "location": "us-east-1"
      }
    ]
  }
}
EOF
"
* tried different asn range, still error

Anything else could have caused the error?

Appreciate any insights here!

re:Post Agent · Answer

The "Unable to determine opt-in region status" error you're encountering with the PutCoreNetworkPolicy operation suggests there might be an issue with region validation in your AWS environment.

Here are some additional things to check:

1. **Region Opt-in Status**: Even though us-east-1 is typically enabled by default, there might be an issue with the service's ability to verify the region's opt-in status. The error indicates that the AWS Global Networks service is unable to determine if the region you're using is properly opted-in for your account.

2. **IAM Permissions**: While you've granted admin permissions, ensure that the role specifically has permissions for the account management API actions related to region opt-in status checking. The role might need explicit permissions to call the GetRegionOptStatus API.

3. **Cross-Account Issues**: Check if there are any cross-account configurations involved. The error could occur if the service is trying to validate region status across accounts and doesn't have proper permissions.

4. **Service Availability**: Verify that AWS Network Manager service is fully available in your region and account. There might be temporary service issues.

5. **CLI/SDK Version**: Ensure you're using the latest version of the AWS CLI or SDK, as older versions might have bugs related to region validation.

6. **AWS Organizations Policies**: If your account is part of an AWS Organization, check if there are any service control policies (SCPs) that might be restricting access to region-related operations.

7. **Try CloudShell**: As an alternative approach, try running the same command in AWS CloudShell to see if the environment makes a difference.

If the issue persists after checking these items, it might be worth contacting AWS Support as this could be related to an underlying service issue with region validation in the Network Manager service.  
**Sources**  
[PutCoreNetworkPolicy - AWS Global Networks for Transit Gateways](https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_PutCoreNetworkPolicy.html)  
[GetRegionOptStatus - AWS Account Management](https://docs.aws.amazon.com/accounts/latest/reference/API_GetRegionOptStatus.html)  
[CreateCoreNetwork - AWS Global Networks for Transit Gateways](https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateCoreNetwork.html)

An error occurred (AccessDeniedException) when calling the PutCoreNetworkPolicy operation: Unable to determine opt-in region status.

Add your answer

Relevant content