Troubleshooting Basic AWS IAM Permission Errors

Avatar
Adedayo Samuel
  • Updated

Scenario

Say you’re performing an operation using Terraform and you run into an AWS IAM permission-related error.

 

Example

Error: error listing tags for Route53 Resolver rule (arn:aws:route53resolver:eu-west-1:<acctID>:resolver-rule/rslvr-rr-xxxx): 
InvalidParameterException: [RSLVR-00907] You are not authorized to do this operation on shared resource
{
  RespMetadata: {
      StatusCode: 400,
      RequestID: "xxxx"
    },
  Message_: "[RSLVR-00907] You are not authorized to do this operation on shared resource"
}

 

How do you troubleshoot this?

We have the StatusCode and affected AWS service displayed in the error. The first thing you can do is check the error code on the website for this specific AWS service.

Googling “route53 resolver rule error code 400” will lead you to the Common Errors section of the Amazon Route53 API reference documentation - where we see that the status code 400 means “You do not have sufficient access to perform this action.”

The good thing is that we know the exact resolver rule affected arn:aws:route53resolver:eu-west-1:<acctID>:resolver-rule/rslvr-rr-xxxx, and that we are not authorized to perform the operation. But what particular part of our access model is the problem?

 

Terraform log investigation

This is where terraform debugging comes into play. For that, we’re going to use the most-detailed logging level available to us - the trace log. The trace log shows the API operations behind your Terraform command. To learn how to gather a trace log for the terraform run that produced the error, please see this guide here.

In the trace log, search the affected resource ARN arn:aws:route53resolver:eu-west-1:<acctID>:resolver-rule/rslvr-rr-xxxx to see the exact API call that caused the error.

---[ REQUEST POST-SIGN ]-----------------------------
POST / HTTP/1.1
Host: route53resolver.eu-west-1.amazonaws.com
User-Agent: aws-sdk-go/1.36.19 (go1.15.5; windows; amd64) APN/1.0 HashiCorp/1.0 Terraform/0.13.6 (+https://www.terraform.io)
Content-Length: 105
Authorization: AWS4-HMAC-SHA256 Credential=XXXXXXXXXXXXXXXXXXXX/20210120/eu-west-1/route53resolver/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date;x-amz-security-token;x-amz-target, Signature=xxxx
Content-Type: application/x-amz-json-1.1
X-Amz-Date: 20210120T112258Z
X-Amz-Security-Token: xxxx
X-Amz-Target: Route53Resolver.ListTagsForResource
Accept-Encoding: gzip

{"ResourceArn":"arn:aws:route53resolver:eu-west-1:<acctID>:resolver-rule/rslvr-rr-xxxx"}

Here you can see that the exact API call is the Route53Resolver.ListTagsForResource - which is the permission we didn’t have/was denied.

 

Solution

To fix, check the permissions for the IAM User (or Role) and verify that you have the right scope of access for the action Route53Resolver.ListTagsForResource and resource arn:aws:route53resolver:eu-west-1:<acctID>:resolver-rule/rslvr-rr-xxxx you’re applying changes to.

 

Additional Reading/References

Articles in this section

See more

Related articles