How do I troubleshoot SCP explicit deny errors in AWS Organizations?

Short description

You can use Organizations Service control policies (SCPs) to manage permissions for member accounts in your organization. However, SCPs don't grant permissions to AWS Identity and Access Management (IAM) identities in your organization.

To grant access to an API action, both the SCP and the IAM identity-based policy must allow access for the member account.

Resolution

To confirm that the explicit deny error occurred because an SCP denied the request, use the AWS CloudTrail Event history to search for the event name. Then, from the AWS Organizations management account use the Organizations console to either remove or modify the policy to allow the API action request.

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

Review the CloudTrail Event history

Use the CloudTrail console

You can view all supported services and integrations and event types, such as create, modify, delete, and non-mutable activities, from the past 90 days. You don't need to set up a trail to use CloudTrail Event history.

For instructions, see Viewing recent CloudTrail events in the CloudTrail console.

Use the AWS CLI

Run the lookup-events AWS CLI command to look up management events or CloudTrail Insights events for the past 90 days.

Run the filter-log-events command to apply metric filters to search for specific terms, phrases, and values in your log events. You can then change them to CloudWatch metrics and alarms.

For more information, see Filter pattern syntax for metric filters, subscription filters, filter log events, and Live Tail.

Use the AWS Organizations console to remove or modify the SCP

Complete the following steps:

1. Open the AWS Organizations console with your AWS Organization management account.
2. In the navigation pane, choose AWS accounts, and then choose the affected member account.
3. Choose the Policies tab, and then review all applied SCPs that restrict access to API actions.
4. To edit the policy, select the SCP, choose Edit policy. After you edit the policy, choose Save changes.
   -or-
   To delete the policy, select the SCP, and then choose Delete
   -or-
   To detach the policy, select the SCP, and then choose Detach.

From the member account, run the API action again to confirm that the explicit deny error is resolved.

For more information, see Viewing information for Organizations (console).