排查访问被拒绝错误消息 - Amazon Identity and Access Management
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 Amazon Web Services 服务入门

排查访问被拒绝错误消息

当 Amazon 显式或隐式拒绝授权请求时,将显示拒绝访问错误讯息。当策略包含特定的 Amazon 操作的 Deny 语句时,将发生显式拒绝。当没有适用的 Deny 语句且没有适用的 Allow 语句时,会发生隐式拒绝。由于 IAM policy 默认拒绝 IAM 主体,因此该策略必须显式允许主体执行操作。否则,该策略会隐式拒绝访问。有关更多信息,请参阅显式拒绝和隐式拒绝之间的区别

大多数拒绝访问的错误消息都以 User user is not authorized to perform action on resource because context 格式显示。在此示例中,user(用户)是无法获得访问权限的 Amazon 资源名称(ARN)action(操作)是策略拒绝的服务操作,resource(资源)是策略所执行操作的资源的 ARN。context(上下文)字段表示有关策略类型的其他上下文,用于解释策略拒绝访问的原因。

当策略因包含 Deny 语句而显式拒绝访问时,Amazon 将在拒绝访问错误消息中包含短语 with an explicit deny in a type policy。当策略隐式拒绝访问时,Amazon 将在拒绝访问错误消息中包含短语 because no type policy allows the action action

如果同一策略类型的多个策略拒绝授权请求,则 Amazon 在访问被拒绝错误消息中没有指定策略编号。如果授权请求被多种策略类型拒绝,则 Amazon 仅在错误消息中包含其中一种策略类型。

拒绝访问错误消息示例

下面的示例展示了不同类型的拒绝访问错误消息的格式。

由于服务控制策略而拒绝访问

对于以下错误,请在服务控制策略(SCP)中检查 codecommit:ListRepositoriesDeny 语句或缺失的 Allow 语句。

注意

当 SCP 拒绝访问时,错误消息始终包含短语 due to an explicit deny in a Service Control Policy,即使拒绝是隐式的。

User: arn:aws:iam::777788889999:user/JohnDoe is not authorized to perform: codecommit:ListRepositories with an explicit deny in a service control policy

由于 VPC 端点策略而拒绝访问

  • 隐式拒绝:对于以下错误,请在虚拟私有云(VPC)端点策略中检查 codecommit:ListRepositories 的缺失 Allow 语句。

    User: arn:aws:iam::123456789012:user/JohnDoe is not authorized to perform: codecommit:ListRepositories because no VPC endpoint policy allows the codecommit:ListRepositories action
  • 显式拒绝:对于以下错误,请在 VPC 端点策略中检查 codecommit:ListDeployments 的显式 Deny 语句。

    User: arn:aws:iam::123456789012:user/JohnDoe is not authorized to perform: codedeploy:ListDeployments on resource: arn:aws:codedeploy:us-east-1:123456789012:deploymentgroup:* with an explicit deny in a VPC endpoint policy

由于权限边界而拒绝访问

  • 隐式拒绝:对于以下错误,请在权限边界中检查 codecommit:ListDeployments 的缺失 Allow 语句。

    User: arn:aws:iam::123456789012:user/JohnDoe is not authorized to perform: codedeploy:ListDeployments on resource: arn:aws:codedeploy:us-east-1:123456789012:deploymentgroup:* because no permissions boundary allows the codedeploy:ListDeployments action
  • 显式拒绝:对于以下错误,请在权限边界中检查 sagemaker:ListModels 的显式 Deny 语句。

    User: arn:aws:iam::777788889999:user/JohnDoe is not authorized to perform: sagemaker:ListModels with an explicit deny in a permissions boundary

由于会话策略而拒绝访问

  • 隐式拒绝:对于以下错误,请在会话策略中检查 codecommit:ListRepositories 的缺失 Allow 语句。

    User: arn:aws:iam::123456789012:user/JohnDoe is not authorized to perform: codecommit:ListRepositories because no session policy allows the codecommit:ListRepositories action
  • 显式拒绝:对于以下错误,请在会话策略中检查 codecommit:ListDeployments 的显式 Deny 语句。

    User: arn:aws:iam::123456789012:user/JohnDoe is not authorized to perform: codedeploy:ListDeployments on resource: arn:aws:codedeploy:us-east-1:123456789012:deploymentgroup:* with an explicit deny in a sessions policy

由于基于资源的策略而拒绝访问

  • 隐式拒绝:对于以下错误,请在基于资源的策略中检查 secretsmanager:GetSecretValue 的缺失 Allow 语句。

    User: arn:aws:iam::123456789012:user/JohnDoe is not authorized to perform: secretsmanager:GetSecretValue because no resource-based policy allows the secretsmanager:GetSecretValue action
  • 显式拒绝:对于以下错误,请在基于资源的策略中检查 secretsmanager:GetSecretValue 的显式 Deny 语句。

    User: arn:aws:iam::123456789012:user/JohnDoe is not authorized to perform: secretsmanager:GetSecretValue on resource: arn:aws:secretsmanager:us-east-1:123456789012:secret:* with an explicit deny in a resource-based policy

由于角色信任策略而拒绝访问

  • 隐式拒绝:对于以下错误,请在角色信任策略中检查 sts:AssumeRole 的缺失 Allow 语句。

    User: arn:aws:iam::123456789012:user/JohnDoe is not authorized to perform: sts:AssumeRole because the role trust policy allows the sts:AssumeRole action
  • 显式拒绝:对于以下错误,请在角色信任策略中检查 sts:AssumeRole 的缺失 Allow 语句。

    User: arn:aws:iam::777788889999:user/JohnDoe is not authorized to perform: sts:AssumeRole with an explicit deny in the role trust policy

由于基于身份的策略而拒绝访问

  • 隐式拒绝:对于以下错误,请在附加到用户 JohnDoe 的基于身份的策略中检查 codecommit:ListRepositories 的缺失 Allow 语句。

    User: arn:aws:iam::123456789012:user/JohnDoe is not authorized to perform: codecommit:ListRepositories because no identity-based policy allows the codecommit:ListRepositories action
  • 显式拒绝:对于以下错误,请在附加到用户 JohnDoe 的基于身份的策略中检查 codedeploy:ListDeployments 的显式 Deny 语句。

    User: arn:aws:iam::123456789012:user/JohnDoe is not authorized to perform: codedeploy:ListDeployments on resource: arn:aws:codedeploy:us-east-1:123456789012:deploymentgroup:* with an explicit deny in an identity-based policy

由于其他策略,在 VPC 请求失败时拒绝访问

对于以下错误,请在 SCP 中检查 SNS:Publish 的显式 Deny 语句。

User: arn:aws:sts::111122223333:assumed-role/role-name/role-session-name is not authorized to perform: SNS:Publish on resource: arn:aws:sns:us-east-1:444455556666:role-name-2 with an explicit deny in a VPC endpoint policy transitively through a service control policy