Search code examples
amazon-web-servicesamazon-ec2amazon-iamaws-policies

Decoding an Encrypted Authorization/Error message in AWS

Some actions that involve IAM permissions may return a Client.UnauthorizedOperation responses.

Solution

  • You can decrypt the message from the CLI using the following command:

    $> aws sts decode-authorization-message --encoded-message <encoded message from error>

    This will give you an output that looks like:

    {"allowed":false,"explicitDeny":false,"matchedStatements":{"items":[]},"failures":{"items":[]},"context":{"principal":{"id":"APOZIAANAVSK6I6FK2RQI:i-66c78ee7","arn":"arn:aws:sts::<aws-account-id>:assumed-role/my-role-ec2/i-123456e7"},"action":"iam:PassRole","resource":"arn:aws:iam::<aws-account-id>:role/my-role-ec2","conditions":{"items":[]}}}

    The error message is actually encoded JSON inside "", by default the embedded quotes (") are escaped as \"; to facilitate reading the error, extract the message portion and use a text editor to replace \" with ".