Resource Access Management:How to troubleshoot access permission errors?

Console access

Most access denied pop-up messages in the console provide detailed diagnostic information about the error.

Follow these steps to diagnose and resolve the error.

1. Identify the principal.

   The auth subject section provides detailed information about the principal that made the request. Details include:

   • Identity Type: The type of principal, such as a RAM user, RAM role, or federated user.

   • Identity Information: The unique identifier of the principal. For a RAM user, this is the user ID. For a RAM role, this is in the RoleName:RoleSessionName format. For a federated user, this is in a format like saml-provider/AzureAD.

   • account ID: The ID of the Alibaba Cloud account that owns the principal.

2. Identify the missing permission.

   The Action field shows the specific action that was denied, which you can use to troubleshoot or grant the permission.

3. Identify the relevant policy type.

   The Policy Type field shows the type of policy that caused the denial, including control policy, session policy, trust policy, and identity-based policy (at the account or resource group level). For more information, see Policy evaluation process.

   The policy type determines how you adjust the policy:

   • If the action was denied by a control policy, contact the administrator of the management account in your Resource Directory to grant the permission. A control policy defines the permission boundaries for member accounts in a Resource Directory and takes precedence over policies within an account.

   • If the action was denied by a session policy, contact your account administrator to check the session policy that was passed when the AssumeRole API operation was called.

   • If the action was denied by a trust policy, contact your account administrator to check the trust policy of the assumed RAM role.

   • If the action was denied by an identity-based policy, contact your account administrator to check the permission policies attached to the principal.

4. Determine if the denial was an implicit deny or an explicit deny.

   • Implicit deny: The error message indicates that the action is not authorized, and the Denied Type field shows Insufficient Permissions. In this case, your account administrator must grant the required permission by adding the Action to an Allow statement in a policy.

   • Explicit deny: The error message indicates that the action is explicitly denied, and the Denied Type field shows Explicit Deny. In this case, your account administrator must review the attached policies and check if a Deny statement includes the Action.

     Note

     If the policy type is a control policy, an explicit deny is also returned if the requested action is not included in an Allow statement.

Additionally, for products that support permission diagnosis, you can click Troubleshooting in the error pop-up to view the error's cause and solution.

The Solution section of the permission diagnosis pop-up recommends relevant system policies, such as AliyunRAMFullAccess and AliyunRAMReadOnlyAccess. It also provides quick actions like View Authorization, Create Policy, and Add Permission.

API calls

Error responses from API calls made with an Alibaba Cloud SDK, the CLI, or the OpenAPI Developer Portal provide detailed information. The following example shows an error response returned during debugging in the OpenAPI Developer Portal.

{
  "RequestId": "1090E608-D26F-5A08-BAE3-80D350E9FE20",
  "HostId": "ram.aliyuncs.com",
  "Code": "NoPermission",
  "Message": "You are not authorized to do this action. Resource: acs:ram:*:xxx:user/* Action: ram:ListUsers",
  "Recommend": "https://next.api.aliyun.com/troubleshoot?q=NoPermission&product=Ram",
  "AccessDeniedDetail": {
    "PolicyType": "AccountLevelIdentityBasedPolicy",
    "AuthPrincipalOwnerId": "xxx",
    "EncodedDiagnosticMessage": "AQIBIAAAAMDAbkn...jHF4TLvjT8hp17I0RFKObkV4=",
    "AuthPrincipalType": "SubUser",
    "AuthPrincipalDisplayName": "xxx",
    "NoPermissionType": "ExplicitDeny",
    "AuthAction": "ram:ListUsers"
  }
}

The AccessDeniedDetail field in the error response contains the details of the permission error. Follow these steps to find the cause and resolve the issue.

1. Identify the principal.

   • AuthPrincipalType: The type of principal. SubUser indicates a RAM user, AssumedRoleUser indicates a RAM role, and Federated indicates a federated user.

   • AuthPrincipalDisplayName: The unique identifier of the principal. For a RAM user, this is the user ID. For a RAM role, this is in the RoleName:RoleSessionName format. For a federated user, this is in a format like saml-provider/AzureAD.

   • AuthPrincipalOwnerId: The ID of the Alibaba Cloud account that owns the principal.

2. Identify the missing permission.

   The AuthAction field shows the specific action that was denied, which you can use to troubleshoot or grant the permission.

3. Identify the relevant policy type.

   The PolicyType field shows the type of policy that caused the denial, including control policy, session policy, trust policy, and identity-based policy (at the account or resource group level). For more information, see Policy evaluation process.

   The policy type determines how you adjust the policy:

   • If the action was denied by a control policy, contact the administrator of the management account in your Resource Directory to grant the permission. A control policy defines the permission boundaries for member accounts in a Resource Directory and takes precedence over policies within an account.

   • If the action was denied by a session policy, contact your account administrator to check the session policy that was passed when the AssumeRole API operation was called.

   • If the action was denied by a trust policy, contact your account administrator to check the trust policy of the assumed RAM role.

   • If the action was denied by an identity-based policy, contact your account administrator to check the permission policies attached to the principal.

4. Determine if the denial was an implicit deny or an explicit deny.

   • Implicit deny: The NoPermissionType field returns ImplicitDeny. In this case, your account administrator must grant the required permission by adding the AuthAction to an Allow statement in a policy.

   • Explicit deny: The NoPermissionType field returns ExplicitDeny. In this case, your account administrator must review the attached policies and check if a Deny statement includes the AuthAction.

     Note

     If the policy type is a control policy, an explicit deny is also returned if the requested action is not included in an Allow statement.

Additionally, for products that support permission diagnosis, you can provide the entire content of the EncodedDiagnosticMessage field to your account administrator. The administrator can then use this message on the RAM permission diagnosis page to troubleshoot the issue. To do this, the account administrator must have the ram:DecodeDiagnosticMessage permission.

Granting permissions to a RAM user

When a RAM user uses a cloud product such as ECS, OSS, or RDS, a Permission Denied error is displayed in the console or a Forbidden.RAM error is returned by an API call. This error usually occurs because the RAM user lacks the necessary permissions for that cloud product. To grant permissions to the RAM user, follow these steps:

1. Log in to the RAM console with your Alibaba Cloud account.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the target RAM user and click the username.

4. Click the Permissions tab and then click Grant Permission.

5. In the policy search box, enter the name of the target cloud product, such as ECS. Select the corresponding system policy and grant the permission.

   The following table lists common cloud products and their corresponding system policies.

   Cloud product	Full access policy	Read-only access policy
   ECS	AliyunECSFullAccess	AliyunECSReadOnlyAccess
   OSS	AliyunOSSFullAccess	AliyunOSSReadOnlyAccess
   RDS	AliyunRDSFullAccess	AliyunRDSReadOnlyAccess
   VPC	AliyunVPCFullAccess	AliyunVPCReadOnlyAccess
   SLB	AliyunSLBFullAccess	AliyunSLBReadOnlyAccess

   For more information about system policies, see Manage permissions for RAM users.