IAM AccessDenied Decoded

Sign in and set names:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json
$acct = aws sts get-caller-identity --query Account --output text
$ami = aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text

1Create a role that may launch only t3.micro

Paste this whole block:

@{ Version = '2012-10-17'; Statement = @(@{ Effect = 'Allow'; Principal = @{ AWS = "arn:aws:iam::$($acct):root" }; Action = 'sts:AssumeRole' }) } | ConvertTo-Json -Depth 5 | Set-Content ops-trust.json
@{ Version = '2012-10-17'; Statement = @(
  @{ Sid = 'RunMicroOnly'; Effect = 'Allow'; Action = 'ec2:RunInstances'; Resource = "arn:aws:ec2:ap-south-1:$($acct):instance/*"; Condition = @{ StringEquals = @{ 'ec2:InstanceType' = 't3.micro' } } },
  @{ Sid = 'RunOtherResources'; Effect = 'Allow'; Action = 'ec2:RunInstances'; Resource = @('arn:aws:ec2:ap-south-1::image/*', "arn:aws:ec2:ap-south-1:$($acct):subnet/*", "arn:aws:ec2:ap-south-1:$($acct):network-interface/*", "arn:aws:ec2:ap-south-1:$($acct):security-group/*", "arn:aws:ec2:ap-south-1:$($acct):volume/*") },
  @{ Sid = 'TagOnLaunch'; Effect = 'Allow'; Action = 'ec2:CreateTags'; Resource = '*'; Condition = @{ StringEquals = @{ 'ec2:CreateAction' = 'RunInstances' } } },
  @{ Sid = 'Read'; Effect = 'Allow'; Action = 'ec2:Describe*'; Resource = '*' }) } | ConvertTo-Json -Depth 6 | Set-Content ops-policy.json
$roleArn = aws iam create-role --role-name saat-lab-ops --assume-role-policy-document file://ops-trust.json --query Role.Arn --output text
aws iam put-role-policy --role-name saat-lab-ops --policy-name run-micro --policy-document file://ops-policy.json
aws configure set profile.saat-ops.role_arn $roleArn
aws configure set profile.saat-ops.source_profile saat-admin
aws configure set profile.saat-ops.role_session_name ops-test
aws configure set profile.saat-ops.region ap-south-1
Start-Sleep 15
function Get-Decoded([string]$ErrText) {
  $enc = [regex]::Match($ErrText, 'Encoded authorization failure message: (\S+)').Groups[1].Value
  aws sts decode-authorization-message --encoded-message $enc --query DecodedMessage --output text | ConvertFrom-Json
}
function Test-Launch([string]$Type, [switch]$Tag) {
  $tagArgs = if ($Tag) { @('--tag-specifications', 'ResourceType=instance,Tags=[{Key=course,Value=saatvedha-aws}]') } else { @() }
  aws ec2 run-instances --dry-run --image-id $ami --instance-type $Type --subnet-id $v.PrivateA @tagArgs --profile saat-ops 2>&1 | Out-String
}
Test-Launch t3.micro

You should see this:

An error occurred (DryRunOperation) when calling the RunInstances operation: Request would have succeeded, but DryRun flag is set.

“Would have succeeded” is the success message for a dry run: the permissions are fine and nothing was created. Use this every time you change an EC2 policy.

2Trigger and decode an encoded denial

Ask for a bigger instance, then decode the message:

$err = Test-Launch t3.small
$err.Substring(0, [Math]::Min(330, $err.Length))
$dec = Get-Decoded $err
$dec.allowed; $dec.explicitDeny; $dec.context.action
($dec.context.conditions.items | Where-Object { $_.key -eq 'ec2:InstanceType' }).values.items.value

You should see something like this:

An error occurred (UnauthorizedOperation) when calling the RunInstances operation: You are not authorized to perform this operation. User: arn:aws:sts::111122223333:assumed-role/saat-lab-ops/ops-test is not authorized to perform: ec2:RunInstances on resource: arn:aws:ec2:ap-south-1:111122223333:instance/* because no identity-based policy allows the ec2:RunInstances action. Enco
False
False
ec2:RunInstances
t3.small

The text already says “no identity-based policy allows”. The decoded message adds the context: explicitDeny is False (so it’s a missing allow, not a deny), and the request asked for t3.small, which the RunMicroOnly condition doesn’t match. Decoding needs sts:DecodeAuthorizationMessage, which is why you run it as saat-admin.

3Prove the policy with the simulator

Paste this whole block:

foreach ($t in 't3.micro', 't3.small') {
  $r = aws iam simulate-principal-policy --policy-source-arn $roleArn --action-names ec2:RunInstances --resource-arns "arn:aws:ec2:ap-south-1:$($acct):instance/*" --context-entries "ContextKeyName=ec2:InstanceType,ContextKeyValues=$t,ContextKeyType=string" --query "EvaluationResults[0].[EvalDecision,MatchedStatements[0].SourcePolicyId]" --output text
  "$t  $r"
}

You should see something like this:

t3.micro  allowed run-micro
t3.small  implicitDeny  None

The simulator agrees and names the policy that matched. In a change request, this output is the proof that a policy does what you say, before it’s deployed.

4See an SCP denial

If you built the sandbox account in Lesson 33, try a Region its SCP blocks:

$scp = aws ec2 describe-vpcs --region us-east-1 --profile saat-sandbox 2>&1 | Out-String
$scp.Substring(0, [Math]::Min(300, $scp.Length))

You should see something like this:

An error occurred (UnauthorizedOperation) when calling the DescribeVpcs operation: You are not authorized to perform this operation. User: arn:aws:sts::444455556666:assumed-role/OrganizationAccountAccessRole/... is not authorized to perform: ec2:DescribeVpcs with an explicit deny in a service control policy

No policy in the sandbox account can override this. The fix, if one is needed, belongs to whoever runs the organization.

✅ Checkpoint: t3.micro dry run says “would have succeeded”, t3.small is denied with a decodable message showing t3.small, the simulator shows allowed vs implicitDeny, and the sandbox call names an SCP.