IAM Permission Denied Errors
Trace IAM AccessDenied errors through policy layers to find the blocking rule.
Overview
Overview
IAM AccessDenied is hard because one generic message covers five different root causes. AWS returns the same response whether the denial came from an explicit Deny, a missing Allow, a Service Control Policy, a permissions boundary or a session policy. Knowing the evaluation order is the foundation of diagnosis.
Five sources of AccessDenied
- Explicit Deny — A Deny statement in any policy in the chain
- Missing Allow — No Allow statement: an implicit deny
- Service Control Policy — Organization-level limit on what the account can do
- Permissions boundary — Ceiling on what a role or user can do
- Session policy — Restriction on the session
Service Control Policies
SCPs work at the AWS Organizations level and are the most common source of mysterious denials. They restrict what is possible in an account whatever its IAM policies allow, so even an account administrator is blocked.
> [!WARNING] A central platform team often applies SCPs, so application developers may not see them.
To check: aws organizations list-policies-for-target with the account ID, then inspect each SCP for Deny blocks or missing Allow blocks for your action.
Permissions boundaries
A boundary sets the maximum permissions a role or user can have, even when attached identity policies grant more. It is common in developer self-service setups: developers can create roles, but cannot grant themselves more than they have.
Tools and what each tells you
- CloudTrail — Every IAM-evaluated call, successful or not, with errorCode (AccessDenied) and errorMessage, which often names the policy that denied it
- CloudTrail search by eventName, userIdentity.arn, errorCode — The exact context of the denial
- IAM Policy Simulator — Tests specific actions against the principal's policies without making real API calls
- aws organizations list-policies-for-target — The SCPs that apply to the account
Key concepts
- Explicit Deny
- A Deny statement in any policy in the evaluation chain. Explicit denies override all Allow statements — they are the highest-priority rule in IAM evaluation.
- Implicit Deny
- The result of no Allow statement existing for the requested action and resource. IAM defaults to deny when no policy explicitly allows an action.
- Service Control Policy (SCP)
- An AWS Organizations policy applied at the organization root, organizational unit, or account level. SCPs set the maximum permissions for all principals in an account, overriding even administrator policies.
- Permissions Boundary
- An IAM policy attached to a role or user that defines the maximum permissions that identity can have. Effective permissions are the intersection of the identity policy and the boundary — neither can exceed the other.
- IAM Policy Simulator
- An AWS tool at policysim.aws.amazon.com that evaluates IAM policies for a specific principal, action, and resource without making real API calls — essential for debugging permission denials.
When to use it
- Diagnosing AccessDenied errors in production where the IAM policy looks correct at first glance
- Explaining IAM policy evaluation order and the difference between explicit and implicit denials in interviews
- Designing IAM architectures with permissions boundaries and SCPs for multi-team AWS environments
Interview questions
- A developer says their IAM role has AdministratorAccess but still gets AccessDenied when trying to create an IAM role in a new AWS account. What are the possible causes and how do you diagnose?
Sign up free to read the full topic
More Troubleshooting topics
Start free on Cariara · Coding problems · System design studio