Identity and Access Management · Topic 6 of 6

Access Analysis and Troubleshooting

Find and fix IAM problems with Access Analyzer findings, the policy simulator, credential reports, decoded denial messages and CloudTrail evidence.

  • 6 min
In a nutshell
  • External access findings show resources shared outside your zone of trust, which is the account or the organization.
  • Unused access analysis finds unused roles, keys, passwords and permissions.
  • Policy validation and custom policy checks help in CI/CD to stop risky policies before deployment.

What it is

IAM problems come in two forms: access that is too broad, which is a risk, and access that is denied, which blocks work. AWS provides tools for both, and the exam expects you to match the tool to the question.

For too much access, use IAM Access Analyzer, credential reports and last accessed data. For denied requests, use error messages, the policy simulator and CloudTrail.

Too much accessriskAccess Analyzerfindings and checksAccess deniedblocked workError message and CloudTrailwhich policyFixpolicy or trust

How it works

IAM Access Analyzer

Access Analyzer has several analyses.

AnalysisWhat it finds
External accessResources shared outside your zone of trust (the account or the organization), such as S3 buckets, IAM roles, KMS keys, Lambda functions, SQS queues and Secrets Manager secrets
Unused accessUnused roles, users, access keys, passwords and permissions, based on a tracking period you choose
Policy validationErrors, security warnings and suggestions for a policy you are writing
Custom policy checksWhether a new policy grants more access than a reference policy, or grants access to named actions
Policy generationA least privilege policy drafted from the CloudTrail activity of a role

The zone of trust is a choice. An analyzer for the organization treats other accounts in the organization as trusted, while an account level analyzer flags any other account. Findings can be archived with rules when an access is intended.

# AWS CLI: validate a policy document before using it
aws accessanalyzer validate-policy \
  --policy-document file://policy.json \
  --policy-type IDENTITY_POLICY

Custom policy checks, such as check-no-new-access, can run in a CI/CD pipeline so that a pull request fails when a change widens access.

Other review tools

  • Credential report. A CSV of all users in an account with password age, MFA status and access key usage. Generate it, then get it.
# AWS CLI
aws iam generate-credential-report
aws iam get-credential-report --query Content --output text | base64 --decode
  • Access Advisor (last accessed data). Shows which services an identity used and when, so you can remove unused permissions.
  • IAM policy simulator. Tests whether identities would be allowed or denied certain actions on resources, including the effect of boundaries and SCPs, without making the real call.

Reading a denial

An AccessDenied or UnauthorizedOperation error is the starting point. Newer messages say which kind of policy caused the denial, for example "no identity-based policy allows the action" or "with an explicit deny in a service control policy".

Some services return an encoded authorization failure message. Decode it with STS.

# AWS CLI: needs the sts:DecodeAuthorizationMessage permission
aws sts decode-authorization-message \
  --encoded-message <encoded-text> --query DecodedMessage --output text

The decoded text shows the action, resource, principal and the matching policy results. CloudTrail also records the errorCode and errorMessage for the failed call, with the full userIdentity.

A troubleshooting method

Use the evaluation order.

  1. Is there an explicit deny anywhere: identity, resource, SCP, RCP, boundary or session policy?
  2. Does an SCP or RCP allow the action in this account?
  3. Does the identity policy allow the action on this resource?
  4. Does the permission boundary or session policy allow it?
  5. For cross account access, does the resource policy allow the other account?
  6. Do the conditions match: MFA, source network, tags, Region, TLS?

Common causes and fixes

SymptomLikely cause
Cannot assume a roleTrust policy does not name the caller, missing external ID or MFA, caller lacks sts:AssumeRole
Allowed in the console policy view but still deniedSCP, boundary, session policy or explicit deny elsewhere
Cross account S3 access deniedMissing bucket policy allow, or object ownership problem for objects written by another account
KMS decrypt deniedKey policy does not allow the principal, or the grant is missing
Works from the console but not from a VPCEndpoint policy or aws:SourceVpce condition blocks it
Service cannot call another serviceMissing role, missing iam:PassRole or service principal not trusted
Denied only without MFAaws:MultiFactorAuthPresent condition, and the call used long term keys
Denied after enabling a new Regionaws:RequestedRegion condition in an SCP

For an S3 object upload by another account, the bucket owner may not own the object unless object ownership is set to bucket owner enforced. This is a classic cross account trap.

DeniedAccessDenieddecodeWhich policymessage or simulatorcheckLayersSCP, boundary, session, resourceFixsmallest change

Fixing with least privilege

After fixing the denial, avoid the temptation to attach an administrator policy. Use Access Analyzer policy generation from CloudTrail to produce a policy that matches real usage, and remove unused permissions when unused access findings appear.

What to remember for the exam

  • External access findings show resources shared outside your zone of trust, which is the account or the organization.
  • Unused access analysis finds unused roles, keys, passwords and permissions.
  • Policy validation and custom policy checks help in CI/CD to stop risky policies before deployment.
  • Policy generation drafts least privilege policies from CloudTrail activity.
  • The credential report lists users with MFA status, password age and key usage.
  • aws sts decode-authorization-message decodes an encoded denial and needs its own permission.
  • The policy simulator tests policy effects without making real API calls.
  • For cross account S3 issues, check the bucket policy and object ownership settings.
Exam tip

"Identify roles and permissions that have not been used in 90 days so they can be removed" is an unused access analyzer question, not Access Advisor alone.

Common mistakes

Debugging only the identity policy. Many denials come from an SCP, a boundary, a resource policy or a condition.

Ignoring the zone of trust setting. An account scoped analyzer reports other accounts in your organization as external.

Fixing a denial with *. This hides the real cause and widens access.

Forgetting key policies. An identity policy that allows kms:Decrypt is not enough if the key policy does not trust IAM.

Watch out

The policy simulator may not reproduce every factor of real evaluation, such as the context of your conditions, so confirm a fix with a real call and CloudTrail.

Check yourself

  • Which tool tells you a bucket is shared with an account outside your organization?

    IAM Access Analyzer external access findings.

  • How do you read an encoded authorization failure message?

    Call aws sts decode-authorization-message, which requires the sts:DecodeAuthorizationMessage permission.

  • Name two places an explicit deny can hide.

    An SCP or RCP at the organization level, and a resource policy on the target or a permissions boundary on the caller.

Topic 6 of 6 in Identity and Access Management

Test yourself on Identity and Access Management

The full AWS SCS-C03 question bank has 858 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.