DecodeDiagnosticMessage

Decodes the permission diagnostic information from the response body of a request that was denied due to missing RAM permissions.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

ram:DecodeDiagnosticMessage

get

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
EncodedDiagnosticMessage	string	No	The encoded diagnostic message obtained from the `AccessDeniedDetail.EncodedDiagnosticMessage` field in the response body when an API request is denied due to insufficient permissions. Pass this parameter to decode the permission diagnostic information when calling this operation.	AQEAAAAAZBgxr0U1MjA1NTM1LUM4BBktMzE5RS1CODgxLUU1QTI0RDNFQTM1****

Response elements

Element	Type	Description	Example
	object	The response.
RequestId	string	The request ID.	D2331703-AADF-5564-BA9B-26CD51A33BA0
DecodedDiagnosticMessage	object	The decoded diagnostic message.
ExplicitDeny	boolean	Indicates whether the denial is explicit. Valid values: true : Shows deny false : Does not show deny	true
NoPermissionPolicyType	string	The policy type that caused the permission denial. Valid values: AssumeRolePolicy : Role trust policy ControlPolicy : Control policies AccountLevelIdentityBasedPolicy : Identity-based policies (account level) ResourceGroupLevelIdentityBasedPolicy : Identity-based policies (resource group level) SessionPolicy : Session policies	AccountLevelIdentityBasedPolicy
AuthAction	string	The action used for authentication in the user request.	ram:DecodeDiagnosticMessage
AuthResource	string	The resource used for authentication in the user request.	*
AuthPrincipal	object	The principal used for authentication in the user request.
AuthPrincipalType	string	The identity type used for authentication in the user request. Valid values: SubUser : RAM users AssumedRoleUser : RAM roles Federated : SSO federated identity	SubUser
AuthPrincipalOwnerId	string	The Alibaba Cloud account UID of the identity used for authentication in the user request.	196813200012****
AuthPrincipalDisplayName	string	The identity identifier used for authentication in the user request, as follows: RAM user: The UID of the RAM user. RAM role: The role name and role session name (for example, RoleName:RoleSessionName). SSO federated identity: The identity provider type and name (for example, saml-provider/AzureAD).	28877424437521****
AuthConditions	array<object>	The list of conditions used for authentication in the user request.
	object	An authentication condition.
ConditionKey	string	The key of the authentication condition.	acs:SourceIp
ConditionValues	array	The list of values corresponding to the authentication condition key.
	string	A condition value corresponding to the authentication condition key.	172.16.215.218
MatchedPolicies	array<object>	The list of policies matched during authentication.
	object	A policy matched during authentication.
Effect	string	The policy effect. Valid values: Deny : Deny Allow : Allow	Deny
PolicyIdentifier	string	The policy name, as follows: Control policy: The control policy ID. RAM access policy: The access policy name.	MyPolicyName
PolicyType	string	The policy type. Valid values: Custom : Custom policies System : System policies	Custom
PolicyVersion	string	The policy version number. Note Only custom policies have version numbers.	v1
AttachedEntityType	string	The entity type to which the policy is attached. Valid values: RamUser : RAM users RamRole : RAM roles ResourceDirectoryTarget : Resource directory entity RamGroup : RAM user groups	RamUser
AttachedScope	string	The scope to which the policy is attached. Valid values: Account : Alibaba Cloud account Folder : Resource directory folders ResourceGroup : Resource groups	Account

Examples

Success response

JSON format

{
  "RequestId": "D2331703-AADF-5564-BA9B-26CD51A33BA0",
  "DecodedDiagnosticMessage": {
    "ExplicitDeny": true,
    "NoPermissionPolicyType": "AccountLevelIdentityBasedPolicy",
    "AuthAction": "ram:DecodeDiagnosticMessage",
    "AuthResource": "*",
    "AuthPrincipal": {
      "AuthPrincipalType": "SubUser",
      "AuthPrincipalOwnerId": "196813200012****",
      "AuthPrincipalDisplayName": "28877424437521****"
    },
    "AuthConditions": [
      {
        "ConditionKey": "acs:SourceIp",
        "ConditionValues": [
          "172.16.215.218"
        ]
      }
    ],
    "MatchedPolicies": [
      {
        "Effect": "Deny",
        "PolicyIdentifier": "MyPolicyName",
        "PolicyType": "Custom",
        "PolicyVersion": "v1",
        "AttachedEntityType": "RamUser",
        "AttachedScope": "Account"
      }
    ]
  }
}

Error codes

HTTP status code	Error code	Error message
400	NotSupport	This method can only be invoked by customer, sub user and assumed role user.
400	EncodedMessageExpire	The EncodedDiagnosticMessage is expired.
403	NoPermission	You do not have the required permissions.
404	SearchInaccurate	The search result is inaccurate, please retry later.
404	EntityNotExist	The specific DecodedDiagnosticMessage cannot be found.
429	TooManyRequests	Too many search requests at same time, please retry later.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.