CODEWITHSUNDEEP
amazon-web-servicesamazon-ec2
user971741
user971741

Reputation:

User: x is not authorized to perform: (sts:DecodeAuthorizationMessage)`

I am facing an issue while trying to provision my EC2 instance through Terraform. However, to debug that issue I am trying to decode the encoded authorization failure message.

But when trying to call that sts decode API I am getting:

Error: A client error (AccessDenied) occurred when calling the DecodeAuthorizationMessage operation: User: xxx is not authorized to perform: (sts:DecodeAuthorizationMessage)

Now I don't know which specific permission should I give to my IAM user to be able to decode this message?

Updates:

enter image description here

Upvotes: 9

Views: 6686

Answers (1)

Marcin
Marcin

Reputation: 238249

Based on the error message quotued, it seems that sts:DecodeAuthorizationMessage permissions are required:

Decodes additional information about the authorization status of a request from an encoded message returned in response to an AWS request.

Subsequently you could add the following policy as an inline policy, for example, into your IAM user or its group:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowStsDecode",
            "Effect": "Allow",
            "Action": "sts:DecodeAuthorizationMessage",
            "Resource": "*"
        }
    ]
}

The same could be added through Customer Managed Policy if inline policies are not desired.

Upvotes: 15

Related Questions