Decode RAM Access Denied Diagnostic Messages via API - Resource Access Management - Alibaba Cloud - Resource Access Management

Decodes the permission diagnostic information from the response body of a request that was denied due to insufficient RAM permissions.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

ram:DecodeDiagnosticMessage

get

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
EncodedDiagnosticMessage	string	No	The encoded diagnostic information obtained from the `AccessDeniedDetail.EncodedDiagnosticMessage` field in the response body when an API request is denied due to insufficient permissions. This parameter is used to decode the permission diagnostic information and must be specified when you call this operation.	AQEAAAAAZBgxr0U1MjA1NTM1LUM4BBktMzE5RS1CODgxLUU1QTI0RDNFQTM1****

Response elements

Element	Type	Description	Example
	object	The return value.
RequestId	string	The request ID.	D2331703-AADF-5564-BA9B-26CD51A33BA0
DecodedDiagnosticMessage	object	The decoded diagnostic information.
ExplicitDeny	boolean	Indicates whether the denial is an explicit deny. Valid values: true : explicit deny. false : not an explicit deny.	true
NoPermissionPolicyType	string	The type of the policy that caused the permission denial. Valid values: AssumeRolePolicy : role trust policy. ControlPolicy : control policy. AccountLevelIdentityBasedPolicy : identity-based policy (account level) ResourceGroupLevelIdentityBasedPolicy : identity-based policy (resource group level) SessionPolicy : session policy.	AccountLevelIdentityBasedPolicy
AuthAction	string	The operation information used for authentication in the user request.	ram:DecodeDiagnosticMessage
AuthResource	string	The resource information used for authentication in the user request.	*
AuthPrincipal	object	The principal information used for authentication in the user request.
AuthPrincipalType	string	The identity type used for authentication in the user request. Valid values: SubUser : Resource Access Management (RAM) user. AssumedRoleUser : RAM role. Federated : SSO federated identity.	SubUser
AuthPrincipalOwnerId	string	The UID of the Alibaba Cloud account to which the identity used for authentication in the user request belongs.	196813200012****
AuthPrincipalDisplayName	string	The identity identifier used for authentication in the user request. Valid values: Resource Access Management (RAM) user: the UID of the RAM user. RAM role: the role name and role session name (for example, RoleName:RoleSessionName). SSO federated identity: the identity provider type and identity provider name (for example, saml-provider/AzureAD).	28877424437521****
AuthConditions	array<object>	The list of conditions used for authentication in the user request.
	object	The authentication condition.
ConditionKey	string	The key of the authentication condition.	acs:SourceIp
ConditionValues	array	The list of values that correspond to the authentication condition key.
	string	The condition value that corresponds to the authentication condition key.	172.16.215.218
MatchedPolicies	array<object>	The list of policies matched during authentication.
	object	The policy matched during authentication.
Effect	string	The policy effect. Valid values: Deny : deny. Allow : allow.	Deny
PolicyIdentifier	string	The policy name information. Valid values: Control policy: the ID of the control policy. RAM permission policy: the name of the access policy.	MyPolicyName
PolicyType	string	The policy type. Valid values: Custom : custom policy. System : system policy.	Custom
PolicyVersion	string	The version number of the policy. Note Only custom policies have version numbers.	v1
AttachedEntityType	string	The type of the entity to which the policy is attached. Valid values: RamUser : Resource Access Management (RAM) user. RamRole : RAM role. ResourceDirectoryTarget : resource directory entity. RamGroup : RAM user group.	RamUser
AttachedScope	string	The authorization scope of the policy. Valid values: Account : Alibaba Cloud account. Folder : resource directory folder. ResourceGroup : resource group.	Account

Examples

Success response

JSON format

{
  "RequestId": "D2331703-AADF-5564-BA9B-26CD51A33BA0",
  "DecodedDiagnosticMessage": {
    "ExplicitDeny": true,
    "NoPermissionPolicyType": "AccountLevelIdentityBasedPolicy",
    "AuthAction": "ram:DecodeDiagnosticMessage",
    "AuthResource": "*",
    "AuthPrincipal": {
      "AuthPrincipalType": "SubUser",
      "AuthPrincipalOwnerId": "196813200012****",
      "AuthPrincipalDisplayName": "28877424437521****"
    },
    "AuthConditions": [
      {
        "ConditionKey": "acs:SourceIp",
        "ConditionValues": [
          "172.16.215.218"
        ]
      }
    ],
    "MatchedPolicies": [
      {
        "Effect": "Deny",
        "PolicyIdentifier": "MyPolicyName",
        "PolicyType": "Custom",
        "PolicyVersion": "v1",
        "AttachedEntityType": "RamUser",
        "AttachedScope": "Account"
      }
    ]
  }
}

Error codes

HTTP status code	Error code	Error message
400	NotSupport	This method can only be invoked by customer, sub user and assumed role user.
400	EncodedMessageExpire	The EncodedDiagnosticMessage is expired.
403	NoPermission	You do not have the required permissions.
404	SearchInaccurate	The search result is inaccurate, please retry later.
404	EntityNotExist	The specific DecodedDiagnosticMessage cannot be found.
429	TooManyRequests	Too many search requests at same time, please retry later.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.