AWS FinOps Agent (Preview) — CreateIntegration (Slack) returns 403 AccessDenied despite AdministratorAccess + documented IAM policy

Question

Here's a public-safe version for re:Post — account ID, IAM ARN, and any account-identifying details are redacted:

---

**Title:** AWS FinOps Agent (Preview) — `CreateIntegration` (Slack) returns 403 AccessDenied despite AdministratorAccess + documented IAM policy

**Tags:** `finops-agent`, `iam`, `slack-integration`, `preview`

**Body:**

I'm hitting a 403 Forbidden on the FinOps Agent `CreateIntegration` API (Slack provider) even though the calling IAM principal has both `AdministratorAccess` **and** the documented FinOps Agent admin setup policy attached. Posting in case others are hitting the same preview-service issue, and to see if anyone has found a workaround while AWS Support investigates.

**Environment:**
- Region: us-east-1
- Principal type: IAM user (console session, temporary credentials)

**Repro steps:**
1. Signed in to AWS Console with an IAM user that has AdministratorAccess + the custom FinOps Agent setup policy below.
2. Went to AWS FinOps Agent console → attempted to connect a Slack integration at the account level.
3. Got `403 Forbidden` on `POST https://finops-agent.us-east-1.api.aws/createIntegration`.

**CloudTrail entry for the failed call:**
```
Event name: CreateIntegration
Event source: finops-agent.amazonaws.com
Error code: AccessDenied
Error message: An unknown error occurred
Request params: {"provider": "SLACK", "code": "HIDDEN_DUE_TO_SECURITY_REASONS"}
```
Notably the error message is generic rather than a specific policy-deny reason, which makes me think this isn't a plain IAM evaluation failure.

**IAM policy attached (redacted resource ARNs use wildcards already, no account-specific info):**
```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "FinOpsAgentAdminSetup",
            "Effect": "Allow",
            "Action": [
                "finops-agent:CreateAgentSpace",
                "finops-agent:GetAgentSpace",
                "finops-agent:ListAgentSpaces",
                "finops-agent:UpdateAgentSpace",
                "finops-agent:DeleteAgentSpace",
                "finops-agent:CreateConnection",
                "finops-agent:GetConnection",
                "finops-agent:ListConnections",
                "finops-agent:UpdateConnection",
                "finops-agent:DeleteConnection",
                "finops-agent:CreateIntegration",
                "finops-agent:GetIntegration",
                "finops-agent:ListIntegrations",
                "finops-agent:DeleteIntegration",
                "finops-agent:CreateOneTimeLoginSession"
            ],
            "Resource": "*"
        },
        {
            "Sid": "IamReadForRolePicker",
            "Effect": "Allow",
            "Action": ["iam:GetRole", "iam:ListRoles"],
            "Resource": "*"
        },
        {
            "Sid": "CreateFinOpsServiceRolesOnly",
            "Effect": "Allow",
            "Action": "iam:CreateRole",
            "Resource": "arn:aws:iam::*:role/service-role/*"
        },
        {
            "Sid": "AttachOnlyFinOpsManagedPolicies",
            "Effect": "Allow",
            "Action": "iam:AttachRolePolicy",
            "Resource": "arn:aws:iam::*:role/service-role/*",
            "Condition": {
                "ArnEquals": {
                    "iam:PolicyARN": [
                        "arn:aws:iam::aws:policy/FinOpsAgentAgentPolicy",
                        "arn:aws:iam::aws:policy/FinOpsAgentOperatorPolicy"
                    ]
                }
            }
        },
        {
            "Sid": "PassFinOpsRolesToService",
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "*",
            "Condition": {
                "StringEquals": {"iam:PassedToService": "finops-agent.amazonaws.com"},
                "ArnLike": {"iam:AssociatedResourceArn": "arn:aws:finops-agent:*:*:agentspace/*"}
            }
        }
    ]
}
```

**Already ruled out:**
- Policy syntax/coverage — `finops-agent:CreateIntegration` is explicitly allowed with `Resource: *`
- Least-privilege gaps — same principal also has AdministratorAccess attached
- Slack app not added to the channel — added per the User Guide prerequisite before attempting the integration

**Suspecting one of:**
- An Organizations SCP intercepting the call before IAM evaluation (wouldn't show up as a specific deny in CloudTrail)
- Account not fully provisioned/allow-listed for the preview despite the console being visible
- A missing service-linked role for `finops-agent.amazonaws.com`
- An undocumented prerequisite for the account-level Slack `CreateIntegration` step specifically

Has anyone else gotten Slack integration working in the preview, and if so, was there a step beyond what's in the User Guide? Also have a Support case open (will update this thread if AWS resolves it).

Taka · Answer

The AWS FinOps Agent (Preview) User Guide "[Creating an agent - AWS FinOps Agent (preview)](https://docs.aws.amazon.com/finops-agent/latest/userguide/creating-an-agent.html#creating-an-agent-manage)" explicitly states the following:
> Before you can delete an agent, you must delete both its Jira and Slack connections.

The issue you are reporting—where the workspace remains locked to the old account on the backend—is highly likely caused by deleting the agent itself without first removing the integrations (as required by the procedure). The most plausible scenario is that a bug in the preview version allowed an action that should have been blocked (deleting an agent while connections still existed), resulting in an orphaned state where the Slack workspace association cannot be unlinked by anyone.

Check the old account to see if any traces of the supposedly deleted agent remain. Specifically:
*   Open the FinOps Agent console for the old account and check the Agents page for any traces (such as an agent with a "deleted" status or orphaned integration records).
*   Even if the agent itself has completely disappeared, try calling the `ListIntegrations` API using the old account's credentials to see if the Slack integration record still exists (assuming there is a CLI/API equivalent to `aws finops-agent list-integrations`).
*   If the integration record is still visible on the old account side in any way, you might be able to call `DeleteIntegration` directly from there (your IAM policy already includes `finops-agent:DeleteIntegration`).

There do not appear to be any hidden commands or workarounds that allow for the deletion of a Slack integration in a standalone manner (i.e., without being linked to an agent).

This situation—where an orphaned backend state was created because deletion occurred out of sequence—is likely an issue stemming from the unfinished nature of the preview version, and it will probably require manual intervention via an AWS Support case.

Riku_Kobayashi · Answer

Hello.

I came across a Japanese blog post explaining how to resolve a 403 error related to Slack integration.  
It might not match your specific situation, but it would be worth checking out.  
The blog mentions that there may be a limit on the number of AWS accounts that can be linked to a single Slack workspace.  
Specifically, it describes an instance where an error occurred when attempting to link multiple AWS accounts to a Slack workspace.  
https://www.qes.co.jp/media/aws/a995

Atmankumar Vaghamshi · Answer

Based on the symptoms - generic AccessDenied rather than a specific IAM deny, despite AdministratorAccess and full finops-agent:CreateIntegration permission, this looks like the Slack workspace-to-account binding issue, not an IAM/SCP problem.

A Slack workspace registers with one AWS account at a time for FinOps Agent. If this workspace was ever connected to a different AWS account's agent before even one that's since been deleted the workspace can stay locked to that old account on the backend, and a new CreateIntegration call from a different account gets rejected with a generic error rather than a specific policy denial. This matches your own note about the account potentially having been "not fully provisioned" it's provisioned fine, but the workspace itself is the thing that's locked elsewhere.

The documented recovery path: on the account the workspace is currently bound to, remove its Slack connections, explicitly Disconnect Slack at the integration level (not just delete the agent), then re-register the integration from the account you actually want. Deleting the agent alone without first removing the Slack connection leaves the workspace stuck, which fits your situation if this workspace was used with FinOps Agent anywhere before.

Separately, worth checking regardless: the Slack integration prerequisites (https://docs.aws.amazon.com/finops-agent/latest/userguide/slack-integration.html) require the console to be out of multi-session mode before CreateIntegration will work that's also a documented, independent gate.

If you didn't set this workspace up with FinOps Agent before, it's worth asking whoever else has admin access to that Slack workspace whether they connected it to a different AWS account at any point.

AWS FinOps Agent (Preview) — CreateIntegration (Slack) returns 403 AccessDenied despite AdministratorAccess + documented IAM policy

답변 추가

관련 콘텐츠