By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

403 on Lightsail launch, despite permissions

0

Hi all, Excuse me in advance - I'm a novice AWS user, and the permissioning system and links between services and accounts etc etc is super confusing. I am hopeful this is an easy fix.

I have an organisation of which I am root user. A subaccount created a Lightsail instance. I created a new IAM user on that subaccount and assigned AdminstratorAccess permissions (one of the default templates). Logging in as this user, I was able to stop a Lightsail instance, but I don't seem to have access to start the instance.

I then created a new permission with the following, logged in with said permissions, but the same problem persists. { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lightsail:" ], "Resource": "" } ] }

Any idea what I'm doing wrong? Thanks

  • vtjean
    9 months ago

    Is your account under an AWS Organization Unit? Have you verified the SCP on that Organization Unit?

  • AM
    9 months ago

    Thanks very much for your response. I didnt have a SCP but tried attaching FullAWSAccess ("Allows access to every operation") to the member account (doesn't seem to apply to root/management users). Received the message that a policy with the same name already exists, and it turns out this had been inherited from root. So, the only two accounts in the org I have, including one IAM user on one of the accounts, seem to have full permissions. Yet I still can't restart my Lightsail instance. Maybe I need to reach out to support?

Topics
ComputeSecurity, Identity, & ComplianceManagement & Governance
Tags
Amazon LightsailAWS Identity and Access ManagementAWS Account ManagementIAM Policies
Language
English
AM
asked 9 months ago215 views
1 Answer
0

Hi,

For the 403 error, there are a couple of items that may cause it. Please first see the relevant StartInstance event in CloudTrail to collect the details of the error. The CloudTrail event can provide you details including the principals. And then please check the following configurations: 1, The IAM policy that is attached to the principal. 2, The permission boundary attached to the principal (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html). 3, The SCP policy attached to the IAM account.

For the above policies, please check if there is any explicit deny for the Lightsail service. However, if no explicit deny has been found and it is certain that AdminstratorAccess is attached in the IAM principal, please feel free to open a support ticket for further troubleshooting.

profile pictureAWS
Feng_C
answered 8 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content