Aws the Account Alias Cannot Be Resolved to a Valid Account. Please Check and Try Again.

Amazon Web Services (AWS) Identity & Access Direction (IAM) is a foundational service that provides security in the cloud. Information technology allows yous to manage admission to your AWS services, resources, and applications. It'southward a core service for AWS, only nothing'due south perfect. And while using information technology, you lot may come across errors. But don't sweat it! Permit's dig into the cause and resolution for five common AWS IAM errors.

---

Advance your career in cloud

A Cloud Guru makes it piece of cake (and awesome) to level up your deject career — even if you're totally new to tech. Bank check out ACG'southward current gratis courses or get started now with a free trial.

---

1. AccessDeniedException – I Can't Presume a Role

IAM roles can be used to delegate admission to your AWS resource beyond different AWS accounts that you own. For example, you can share resources in one account with users in a unlike account. This is fabricated possible by establishing trust relationships between the trusting account and your other AWS trusted accounts.

Permit'southward have the case where you want to requite users in your evolution account access to resource in your production account. This could be a case where at that place is a need to promote an update fabricated in development to production. This type of access is chosen cross-account access. If permissions aren't set up correctly, yous may encounter the fault below.

Error
An error occurred (AccessDenied) when calling the AssumeRole performance: User: arn:aws:iam:::user is non authorized to perform: sts:AssumeRole on resource: arn:aws:iam::user:part/role

Crusade
At that place are two possible causes for this AccessDenied error: the user in your development account doesn't have permission to call sts:AssumeRole, or the trust relationship in the production account is not configured correctly.

Assuming yous've already created a part in your product account that a user in your evolution account can presume (to retrieve temporary security credentials), consider the solutions below.

Solution #1
Verify the IAM policy attached to the user in your development business relationship grants that user permission to the sts:AssumeRole activity for the office in your production business relationship they are attempting to assume. You lot must explicitly grant this permission using a policy similar to what's shown below.

{  "Version": "2012-10-17",  "Argument": [{    "Outcome": "Allow",    "Action": ["sts:AssumeRole"],    "Resource": "arn:aws:iam::user:role/function"  }] }

Solution #2
Perchance the user in your development business relationship already has permission to the sts:AssumeRole activity, but the fault still occurs. The next stride is to verify that your evolution business relationship (the business relationship from which you are calling AssumeRole) is ready in your product business relationship as a trusted entity for the role the user is attempting to assume. A function similar to what'south shown below in your product account should do the flim-flam.

{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Let",      "Principal": {        "AWS": "arn:aws:iam::user:user-proper noun"      },      "Action": "sts:AssumeRole",      "Condition": {}    }  ] }

Upon success of assuming the role, the AssumeRole API returns a set of temporary security credentials that can be used to access the production account with the permissions specified in office.

2. AccessDeniedException – I Can't Call an AWS API Operation

When providing access to resource in your AWS account, consider the principle of least-privileged permissions. To the lowest degree-privileged permissions grant just the minimum level of access necessary to perform a given job. This principle highlights the fact that users and services cannot access resources until access is explicitly granted.

Let'southward take the case of a user attempting to call the list bucket performance on an Amazon S3 bucket using the command line interface. The user is met with the error below.

Fault
An error occurred (AccessDenied) when calling the ListBuckets operation: Access Denied

Crusade
The AccessDenied error occurs because the user attempting to perform this activeness has not been explicitly granted access to list the bucket contents. The user will not have access to perform this action unless you explicitly grant it.

Solution
The like shooting fish in a barrel solution is to attach an Inline Policy, similar to the snippet below, to the user.

{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Event": "Allow",            "Action": [                "s3:ListAllMyBuckets",                "s3:ListBucket",                "s3:HeadBucket"            ],            "Resource": "*"        }    ] }

To provide an additional level of security, you can proper name objects in the Resource chemical element instead of using the wildcard *, which represents all resources. If you're not familiar with the Resources element, it specifies the object or objects that the policy covers.

The example below allows access to all items within a specific Amazon S3 bucket using the Resource, the Amazon Resource Name (ARN), and the wildcard *.

{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Event": "Allow",            "Action": [                "s3:ListAllMyBuckets",                "s3:ListBucket",                "s3:HeadBucket"            ],            "Resource": "arn:aws:s3:::bucket_name/*"        }    ] }

---

Let's showtime your AWS journey

Looking to go AWS certified or level up your cloud career? Learn in-demand AWS skills by doing — with ACG.

---

3. UnauthorizedOperation – I am not Authorized to Perform an Performance

When attempting to perform an operation, y'all may encounter an mistake stating you're not authorized to perform that functioning. Let'due south accept the instance of list EC2 instances in an account using the describe-instances action.

Error
An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.

Cause
The UnauthorizedOperation error occurs because either the user or role trying to perform the operation doesn't take permission to describe (or list) EC2 instances.

Solution
The like shooting fish in a barrel solution is to attach an Inline Policy, like to the snippet below, giving the user access.

{    "Version": "2012-ten-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": [                "ec2:DescribeInstances"            ],            "Resources": "*"        }    ] }

It is important to highlight that the DescribeInstances activity cannot exist defined with an ARN in the Resource element. Some services do not allow you to specify deportment for individual resource and crave that y'all employ the wildcard * in the Resource element instead. While y'all can define resource level permissions for a subset of the EC2 APIs, the DescribeInstances activeness currently does not support resource level permissions.  In this case, if you add an ARN number to the Resource chemical element, you will continue to come across the UnauthorizedOperation error.

---

Desire to Prevent the deletion of an Amazon S3 Bucket? Use the AWS Policy Generator tool to create policies that control access to AWS products and resources!

---

4. One Service is Not Authorized to Perform an Action on Some other Service

When managing your AWS resources, you often need to grant one AWS service access to another service to accomplish tasks. Permit's take the case where you need to query a DynamoDB tabular array from a Lambda function. The post-obit Lambda code snippet, to query the USERS table, results in the error shown below.

table = boto3.resources('dynamodb').Table('USERS')  response = tabular array.query(KeyConditionExpression=Key('USER_ID').eq(userid))        

Fault
arn:aws:sts::user:assumed-role/role/part is non authorized to perform: dynamodb:Query on resources: arn:aws:dynamodb:region:business relationship:tabular array/USERS

Cause
This error is caused because the Lambda'south execution role does not have permission to query the USERS DynamoDB table.

Solution
The simple solution is to modify the Lambda's execution role by attaching an Inline Policy similar to the post-obit:

{    "Version": "2012-ten-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": "dynamodb:Query",            "Resource": "arn:aws:dynamodb:region:business relationship:table/USERS"        }    ] }

The aforementioned method can exist followed to allow Lambda admission to Amazon S3. The method described above will piece of work if the Lambda function and S3 bucket are in the aforementioned AWS business relationship. However, if they are in different accounts, you will need to grant Amazon S3 permissions on both the Lambda execution role and the saucepan policy.

v. The policy must contain a valid version string

When creating or modifying a policy, you may run across an error that states the policy must contain a valid Version string. This Version policy element is not the same as multiple version support for managed policies. The Version policy element specifies the language syntax rules that should be used to process the policy. This can exist a bespeak of defoliation for those new to IAM equally they often endeavour to use the current date for the Version policy element; notwithstanding, the Version is limited to a few select values. For instance, using the electric current appointment for the Version string, similar to what'south shown beneath, will cause an error.

{    "Version": "2020-07-30",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Activeness": [                "ec2:DescribeInstances"            ],            "Resource": "*"        }    ] }

Error
This policy contains the following mistake: The policy must contain a valid version string

Cause
The mistake occurs considering Version is limited to a few select values.

Solution
The solution is to utilize one of the valid Version chemical element values. Currently, IAM supports the following Version element values:

• 2012-10-17 – This is the current version of the policy language.
• 2008-10-17 – This is an older version of the policy linguistic communication and doesn't back up newer features.

If you do non include a Version chemical element, the value defaults to 2008-10-17.

---

Learn more nearly IAM

Well, there you have it! Nosotros've reviewed some of the common errors along with resolutions that yous may run into when using IAM.

Looking for more details and tips to assistance you troubleshoot other errors with IAM? Check out my new introductory course around IAM, Identity and Admission Management (IAM) Concepts.

And if yous want to learn more almost IAM in Azure, check out free-for-the-month-of-October grade IAM for Azure. It's one of the two dozen free deject courses available with A Cloud Guru's costless tier.

---

There's more where that came from! A Cloud Guru offers learning paths, quizzes, certification prep, and more.

gabelimensid.blogspot.com

Source: https://acloudguru.com/blog/engineering/fixing-5-common-aws-iam-errors

Share this post