AWS Certified CloudOps Engineer - Associate
Troubleshooting Access with IAM Tools
Turning an AccessDenied into an answer: reading what the error message already tells you, testing with the policy simulator, and using IAM Access Analyzer, last accessed information, the credential report, and CloudTrail to find both the permissions you are missing and the ones you should never have granted.
Intermediate 25 minutes 6 Learning Objectives
- Read an AccessDenied message and name the policy type that produced it
- Distinguish an implicit deny from an explicit deny by the wording of the error alone
- Run the policy simulator and state which policy types it does and does not evaluate
- Select the right IAM Access Analyzer analyzer type for external, internal, and unused access questions
- Interpret last accessed information within its tracking periods and excluded policy types
- Order the diagnostic steps so the cause of a denied request is found with the least work