What Can I Do If I Cannot Access the Consoles and APIs of Some Cloud Services After I Switch to a Trust Agency?

Symptom

An account (delegating account) creates a trust agency for another account (delegated account). After switching to the trust agency, the delegated account cannot access the consoles and APIs of some cloud services.

Cause

• The cloud service does not support trust agencies. For details about services that support trust agencies, see Cloud Services for Using Identity Policies and Trust Agencies.
• The cloud service supports trust agencies, but permissions required for accessing cloud services are not assigned to the switched trust agency.
• The cloud service supports trust agencies and required permissions are assigned to the switched trust agency, but the console or API of the cloud service indirectly accesses other cloud services that do not support trust agencies.

Solution

• If the cloud service does not support trust agencies, you can create an agency and assign permissions required for accessing cloud services to the agency. For details about the differences between trust agencies and agencies, see Trust Policy.
• If the cloud service supports trust agencies, assign permissions required for accessing cloud services to the switched trust agency.
• If the cloud service indirectly accesses other cloud services that do not support trust agencies, create an agency and assign permissions required for accessing cloud services to the agency.