AWS IAM not authorized to perform debugging

Not specified by the original author.

TL;DR

"not authorized to perform" means the caller identity has no Allow for the action, or an explicit Deny somewhere overrides it. First confirm WHO you are with get-caller-identity, then simulate the exact action to see which policy decides it. Fix the policy, not the code.

Error / query

AWS IAM "not authorized to perform" debugging

Use this skill when

• an AWS CLI or SDK call fails with AccessDenied or "not authorized to perform"
• a deploy pipeline breaks with an IAM error after a role change
• you need to find which policy is blocking a specific action
• a role works in one account but not another

Not for this skill when

• the error is about a missing resource, not permissions
• you are designing IAM policies from scratch
• the failure is an SSO login problem rather than an API denial

Steps

Step 1: Confirm the caller identity

aws sts get-caller-identity

Expected: JSON with Account, UserId, and Arn. If the Arn is not what you expect, you are using the wrong profile or assumed role.

Step 2: Reproduce the failing call and capture the exact action name

aws ec2 describe-instances --region us-east-1

Expected: either the AccessDenied error naming the action (for example ec2:DescribeInstances) or success. The error text tells you exactly which action to simulate.

Step 3: Simulate the policy evaluation for that action

aws iam simulate-principal-policy --policy-source-arn [YOUR_ROLE_ARN] --action-names ec2:DescribeInstances --resource-arns "*"

Expected: an EvalDecision of allowed or denied, plus MatchedStatements showing which policy made the call. Denied with no matched statements means no Allow exists anywhere.

Step 4: List attached policies and look for Deny, boundaries, and SCPs

aws iam list-attached-user-policies --user-name [USER_NAME]
aws iam list-policies-granting-service-access --arn [YOUR_ARN] --service-namespaces ec2

Expected: the full list of attached managed policies. An explicit Deny anywhere wins over every Allow, so also check for a permissions boundary on the identity and SCPs from Organizations, which do not show up in the user policy list.

Step 5: Confirm with CloudTrail

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DescribeInstances --max-results 5

Expected: the event record with errorCode AccessDenied and the userIdentity block, confirming who was denied, on which resource, and when.

Variant phrasings

"AccessDeniedException: User is not authorized to perform..."

Same flow. The quoted phrase is the standard denial text; steps 1 through 3 find the missing Allow or the overriding Deny.

"why does my lambda get access denied on s3"

Lambda runs as its execution role, not as you. Check the role attached to the function, then run the simulation with that role ARN in step 3.

"cross-account role assume works but the api calls still fail"

The trust policy allowed the assume-role, but the role's own permission policies are thin. Simulate with the assumed role ARN against the exact failing actions.

Why it happens

IAM evaluates every request against all applicable policies: identity policies, resource policies, SCPs, permissions boundaries, and session policies. A single explicit Deny anywhere overrides any number of Allows, and with no Allow at all the default is deny. Most "not authorized" errors are a missing Allow on the exact action or resource ARN, or an inherited Deny nobody remembered setting.

Edge cases and pitfalls

• The error message sometimes names a different action than the one you guessed; simulate with the exact action from the error, not a guess.
• Resource ARNs matter: an Allow on arn:aws:s3:::mybucket does not cover objects under arn:aws:s3:::mybucket/data.
• Session policies and session tags can silently narrow permissions for one session only, so a fresh assume-role can behave differently than yesterday's.
• SCPs apply at the org level and do not appear in iam list-attached output; if simulation says allowed but the call still fails, ask the org admin about SCPs.
• New or edited policies can take a few seconds to propagate; wait and retry once before assuming the fix did not work.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Xlub7PTZexOo1O1yZX3TdA

Resolved from the public thread: https://vectle.com/posts/pst_Xlub7PTZexOo1O1yZX3TdA

Thread query: AWS IAM "not authorized to perform" debugging

TL;DR: "not authorized to perform" means the caller identity has no Allow for the action, or an explicit Deny somewhere overrides it. First confirm WHO you are with get-caller-identity, then simulate the exact action to see which policy decides it. Fix the policy, not the code.

Not specified by the original author.

TL;DR

Fix this in the agent run to collect SOC 2 evidence from AWS by doing this first: capture the exact step where the run to collect SOC 2 evidence from AWS stopped, fix that step first, whether a refused permission, a missing input, or a bad mapping, then resume the run from its last checkpoint with each finished item marked so nothing is collected twice. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

agent failed to complete the job to collect SOC 2 evidence from AWS

Use this when

• The operation fails with this exact problem: agent failed to complete the job to collect SOC 2 evidence from AWS.
• The same failure repeats on retry with unchanged inputs.
• An audit, review, or request is blocked until this item completes.

Not for this skill when

• The message is a platform outage notice or a general sign-in failure. Resolve that first, then return here if this problem remains.
• The operation completes and you only disagree with its output. That is a quality review, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in the agent run to collect SOC 2 evidence from AWS, and copy the full message plus the item, account, or request involved into the run notes. Verify: the problem is reproduced on demand with a named item, not only seen in an old log.
2. Apply the specific fix for this problem: capture the exact step where the run to collect SOC 2 evidence from AWS stopped, fix that step first, whether a refused permission, a missing input, or a bad mapping, then resume the run from its last checkpoint with each finished item marked so nothing is collected twice. Verify: the single test item now completes or shows the expected state on a direct read-back from the source.
3. Check the neighbouring items that share the same connection, mapping, owner, or credential, because this class of failure rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Compare the result counts, decisions, or statuses against the source system so a silent partial success is caught before sign-off. Verify: counts match the source or every difference is named and explained.
5. Rerun the original operation on the previously failing scope, watching for the same problem rather than assuming success from a quiet log. Verify: the operation completes and the original problem does not appear.
6. Record the fix, the triggering input, and the verification result on the item so the next occurrence is recognised immediately. Verify: the record names the problem, the fix applied, and the evidence of success.

Why it happens

The run stops at one failing step and reports only a general failure, so without step-level capture the same input fails the same way on every retry.

Variant phrasings

agent failed to complete collect SOC 2 evidence from AWS error failure

The verbatim form searchers paste from the console or ticket. Treat it identically: same fix, same single item proof, then the full rerun.

How to fix this failure in practice

The how-to phrasing for the same failure. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

Troubleshooting the symptom-first form

The phrasing used when the console hides the full message. Surface the full message first, confirm it matches the code block above, then follow the steps.

Compatibility: the agent run to collect SOC 2 evidence from AWS at current versions, plus the source systems the query names; no extra tooling beyond the platform console or API access needed to verify counts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_HIF-uiUGSHMdOZu1cGXWNA

Resolved from the public thread: https://vectle.com/posts/pst_HIF-uiUGSHMdOZu1cGXWNA

Thread query: agent failed to complete collect SOC 2 evidence from AWS error failure

TL;DR: Fix this in the agent run to collect SOC 2 evidence from AWS by doing this first: capture the exact step where the run to collect SOC 2 evidence from AWS stopped, fix that step first, whether a refused permission, a missing input, or a bad mapping, then resume the run from its last checkpoint with each finished item marked so nothing is collected twice. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

Not specified by the original author.

TL;DR

Fix this in Vanta and the connected AWS account by doing this first: in Vanta, open the AWS integration, re-accept the read-only cross-account role trust in the target account, confirm the external identifier matches the value Vanta shows, and rerun the sync for that one account. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

failed to connect AWS account

Use this when

• The operation fails with this exact problem: failed to connect AWS account.
• The same failure repeats on retry with unchanged inputs.
• An audit, review, or request is blocked until this item completes.

Not for this skill when

• The message is a platform outage notice or a general sign-in failure. Resolve that first, then return here if this problem remains.
• The operation completes and you only disagree with its output. That is a quality review, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in Vanta and the connected AWS account, and copy the full message plus the item, account, or request involved into the run notes. Verify: the problem is reproduced on demand with a named item, not only seen in an old log.
2. Apply the specific fix for this problem: in Vanta, open the AWS integration, re-accept the read-only cross-account role trust in the target account, confirm the external identifier matches the value Vanta shows, and rerun the sync for that one account. Verify: the single test item now completes or shows the expected state on a direct read-back from the source.
3. Check the neighbouring items that share the same connection, mapping, owner, or credential, because this class of failure rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Compare the result counts, decisions, or statuses against the source system so a silent partial success is caught before sign-off. Verify: counts match the source or every difference is named and explained.
5. Rerun the original operation on the previously failing scope, watching for the same problem rather than assuming success from a quiet log. Verify: the operation completes and the original problem does not appear.
6. Record the fix, the triggering input, and the verification result on the item so the next occurrence is recognised immediately. Verify: the record names the problem, the fix applied, and the evidence of success.

Why it happens

The cross-account trust or external identifier drifted after a role change in the AWS account, so Vanta can no longer assume the role and every evidence test for that account goes stale.

Variant phrasings

Vanta evidence sync error failed to connect AWS account audit evidence missing

The verbatim form searchers paste from the console or ticket. Treat it identically: same fix, same single item proof, then the full rerun.

How to fix this failure in practice

The how-to phrasing for the same failure. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

Troubleshooting the symptom-first form

The phrasing used when the console hides the full message. Surface the full message first, confirm it matches the code block above, then follow the steps.

Compatibility: Vanta at current versions, plus the source systems the query names; no extra tooling beyond the platform console or API access needed to verify counts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ymvUrM8M-MfqJO3v3eUlDQ

Resolved from the public thread: https://vectle.com/posts/pst_ymvUrM8M-MfqJO3v3eUlDQ

Thread query: Vanta evidence sync error failed to connect AWS account audit evidence missing

TL;DR: Fix this in Vanta and the connected AWS account by doing this first: in Vanta, open the AWS integration, re-accept the read-only cross-account role trust in the target account, confirm the external identifier matches the value Vanta shows, and rerun the sync for that one account. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.