AWS now includes the AWS Identity and Access Management (IAM) and AWS Organizations policy’s Amazon Resource Name (ARN) in access denied error messages in same account and same organization scenarios. This allows you to quickly identify the exact policy responsible for the denied access and take action to troubleshoot the issue.
Before this launch, customers had to identify the root cause of access denied errors based only on the policy type in the error message. This launch expedites troubleshooting when you have multiple policies of the same type, as you can directly see which policy to address for explicit deny cases. The error message now includes the policy ARN for Service Control Policies (SCP), Resource Control Policies (RCP), identity-based policies, session policies, and permission boundaries.
This additional context will gradually become available across AWS services in all AWS regions. To learn more, refer to IAM documentation.
Categories: marketing:marchitecture/security-identity-and-compliance,general:products/aws-iam,general:products/aws-organizations
Source: Amazon Web Services
Latest Posts
- Cloudflare Fundamentals, Cloudflare One, Gateway, Organizations – Cloudflare Organizations is generally available
- MC1437671: Microsoft Entra Adds Authenticated Password Change to My Sign-Ins
- MC1490909: Microsoft Defender Vulnerability Management Expands Coverage to Developer Packages in Private Preview
- MC1490905: Microsoft Defender for Office 365 Adds Post-Delivery Protection for Malicious QR Codes in Microsoft Teams
