Viewing any specific IAM entry as administrator shows "Unexpected error" / "Network Failure"

Question

We're using SSO and IAM Identity Center across our org to grant our sysadmins administrative access -- specifically, the Identity Center's relevant Permission Set has a single policy attached, the builtin `arn:aws:iam::aws:policy/AdministratorAccess`.

When one of us logs into such a managed account, we get our federated user ID, `"AWSReservedSSO_AdministratorAccess_/"` with all the appropriate permissions.  Works great.

Except:  when we go into the IAM console on such an account -- note, it's the plain old IAM, not the renamed Identity Center -- we can click on any of the Access Management subcategories, like Users, Roles, Policies, and view the complete list with no problems.  And when clicking on any single specific entry on any of those lists, we can see all the user/role/policy details, **but** at the bottom of the page will appear an error, every time:  red border, title "Unexpected error", content "Network Failure".
![screenshot of error](/media/postImages/original/IMtE9Y_jwvSzOGLZdcAGDzYQ)

Google suggests it might be because we lack the permissions to run "Access Analyzer".  Except that I've just double-checked the `arn:aws:iam::aws:policy/AdministratorAccess` policy, and "Access Analyzer -- Full Access" is literally the first line of the (conveniently alphabetized) permissions list.

What's causing this to appear so reliably on every IAM entry's console page, but nowhere else?

Leo K · Accepted Answer

It sounds like the JavaScript code in the management console running in your browser might just be failing to receive a response from an API it's calling, hence displaying the Network error message.

If you open Developer tools (F12) in your browser, does the Console tab show any errors when loading the page? If not, you could check from the CloudTrail logs both in your current region and in us-east-1 for any errors that the APIs themselves might have returned, including access denied errors that might be caused regardless of otherwise full permissions, if a service control policy in the organisation or a VPC endpoint policy (if you're going through an endpoint) denied the request.

rePostReReadReTry · Answer

There are several warnings about cookies missing SameSite, and some errors about Cross-Origin Requests failing:

```
Content-Security-Policy: The page’s settings blocked the loading of a resource at data:text/plain;base64,Cg== (“connect-src”).
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://prod.log.shortbread.analytics.console.aws.a2z.com/1x1.png?severity=info&message=uiMounted&payload=. (Reason: CORS request did not succeed). Status code: (null).
[above pair of errors is repeated again]

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://access-analyzer.us-east-1.amazonaws.com/policy/generation?principalArn=arn%3Aaws%3Aiam%3A%3A%3Auser%2F. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 200.
[above error is repeated three more times]

Source map error: Error: JSON.parse: unexpected character at line 2 column 1 of the JSON data
Resource URL: https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-2#
Source Map URL: index.js.map

Source map error: Error: request failed with status 403
Resource URL: https://a.b.cdn.console.awsstatic.com/a/v1//main.js
Source Map URL: main.js.map
```

So one kind of CORS error is coming back with a null status code, the other kind is specifically to do with the Access Analyzer but is still returning 200 (success), and then come some warnings about status 403 errors ("forbidden" iirc).

Given that context, I'm willing to toss this into the "probably nothing we can do about this" category.  :-)

Viewing any specific IAM entry as administrator shows "Unexpected error" / "Network Failure"

Add your answer

Relevant content