What Can I Do If I Cannot Find the Action in an Error Message During Policy-based Authorization?

Symptom

The administrator assigns system-defined or custom policies to an IAM user. After the IAM user performs an action beyond the authorization scope, the system displays a message indicating that the action is denied. However, the action mentioned in the message cannot be found in the assigned system-defined or custom policies.

Cause

This action is defined in an identity policy, not a policy.

Solution

• Solution 1: You can use identity policy-based authorization and select the identity policy action mentioned in the displayed message.
• Solution 2: If you only want to use policy-based authorization, you need to find the alias of an identity policy action and add it to the policy.

Before using the second solution, you need to understand the validation logic of policies and identity policies shown in Figure 1.

Figure 1 Validation logic of policies and identity policies

For details about the differences between explicit deny and implicit deny, see Policies and Identity Policy-based Authorization. If the comprehensive evaluation result is implicit deny, the system denies the action. Example error message:

"error_msg": "User: xxx is not authorized to perform action ecs:cloudServers:get on resource ecs:cn-north-5:yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy:instance:zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz because no identity-based policy allows the ecs:cloudServers:get action."

If the comprehensive evaluation result is explicit deny, the system denies the action. Example error message:

"error_msg": "User: xxx is not authorized to perform action ecs:cloudServers:get on resource ecs:cn-north-5:yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy:instance:zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz with an explicit deny in an identity-based policy."

The message describes which action is denied on what resources, but whether this action is defined in a policy or identity policy is not fixed. This is determined by IAM based on the evaluation logic shown in Figure 2.

Figure 2 Evaluation logic

If you only use policy-based authorization and perform actions beyond the authorization scope, the results of both policy and identity policy evaluation are implicit deny, so the action in the displayed message is defined in an identity policy. In this case, if you do not want to use identity policy-based authorization but you cannot find the action in a policy, it means this identity policy action has an alias (different from the identity policy action name) in the policy and all you need to do is to add that alias to the policy. For details about the mapping between identity policy actions and their aliases, see Identity Policy Authorization of the corresponding cloud service.