Here's a public-safe version for re:Post — account ID, IAM ARN, and any account-identifying details are redacted:

---

**Title:** AWS FinOps Agent (Preview) — `CreateIntegration` (Slack) returns 403 AccessDenied despite AdministratorAccess + documented IAM policy

**Tags:** `finops-agent`, `iam`, `slack-integration`, `preview`

**Body:**

I'm hitting a 403 Forbidden on the FinOps Agent `CreateIntegration` API (Slack provider) even though the calling IAM principal has both `AdministratorAccess` **and** the documented FinOps Agent admin setup policy attached. Posting in case others are hitting the same preview-service issue, and to see if anyone has found a workaround while AWS Support investigates.

**Environment:**
- Region: us-east-1
- Principal type: IAM user (console session, temporary credentials)

**Repro steps:**
1. Signed in to AWS Console with an IAM user that has AdministratorAccess + the custom FinOps Agent setup policy below.
2. Went to AWS FinOps Agent console → attempted to connect a Slack integration at the account level.
3. Got `403 Forbidden` on `POST https://finops-agent.us-east-1.api.aws/createIntegration`.

**CloudTrail entry for the failed call:**
```
Event name: CreateIntegration
Event source: finops-agent.amazonaws.com
Error code: AccessDenied
Error message: An unknown error occurred
Request params: {"provider": "SLACK", "code": "HIDDEN_DUE_TO_SECURITY_REASONS"}
```
Notably the error message is generic rather than a specific policy-deny reason, which makes me think this isn't a plain IAM evaluation failure.

**IAM policy attached (redacted resource ARNs use wildcards already, no account-specific info):**
```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "FinOpsAgentAdminSetup",
            "Effect": "Allow",
            "Action": [
                "finops-agent:CreateAgentSpace",
                "finops-agent:GetAgentSpace",
                "finops-agent:ListAgentSpaces",
                "finops-agent:UpdateAgentSpace",
                "finops-agent:DeleteAgentSpace",
                "finops-agent:CreateConnection",
                "finops-agent:GetConnection",
                "finops-agent:ListConnections",
                "finops-agent:UpdateConnection",
                "finops-agent:DeleteConnection",
                "finops-agent:CreateIntegration",
                "finops-agent:GetIntegration",
                "finops-agent:ListIntegrations",
                "finops-agent:DeleteIntegration",
                "finops-agent:CreateOneTimeLoginSession"
            ],
            "Resource": "*"
        },
        {
            "Sid": "IamReadForRolePicker",
            "Effect": "Allow",
            "Action": ["iam:GetRole", "iam:ListRoles"],
            "Resource": "*"
        },
        {
            "Sid": "CreateFinOpsServiceRolesOnly",
            "Effect": "Allow",
            "Action": "iam:CreateRole",
            "Resource": "arn:aws:iam::*:role/service-role/*"
        },
        {
            "Sid": "AttachOnlyFinOpsManagedPolicies",
            "Effect": "Allow",
            "Action": "iam:AttachRolePolicy",
            "Resource": "arn:aws:iam::*:role/service-role/*",
            "Condition": {
                "ArnEquals": {
                    "iam:PolicyARN": [
                        "arn:aws:iam::aws:policy/FinOpsAgentAgentPolicy",
                        "arn:aws:iam::aws:policy/FinOpsAgentOperatorPolicy"
                    ]
                }
            }
        },
        {
            "Sid": "PassFinOpsRolesToService",
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "*",
            "Condition": {
                "StringEquals": {"iam:PassedToService": "finops-agent.amazonaws.com"},
                "ArnLike": {"iam:AssociatedResourceArn": "arn:aws:finops-agent:*:*:agentspace/*"}
            }
        }
    ]
}
```

**Already ruled out:**
- Policy syntax/coverage — `finops-agent:CreateIntegration` is explicitly allowed with `Resource: *`
- Least-privilege gaps — same principal also has AdministratorAccess attached
- Slack app not added to the channel — added per the User Guide prerequisite before attempting the integration

**Suspecting one of:**
- An Organizations SCP intercepting the call before IAM evaluation (wouldn't show up as a specific deny in CloudTrail)
- Account not fully provisioned/allow-listed for the preview despite the console being visible
- A missing service-linked role for `finops-agent.amazonaws.com`
- An undocumented prerequisite for the account-level Slack `CreateIntegration` step specifically

Has anyone else gotten Slack integration working in the preview, and if so, was there a step beyond what's in the User Guide? Also have a Support case open (will update this thread if AWS resolves it).

Questions tagged with AWS FinOps Agent

AWS FinOps Agent (Preview) — CreateIntegration (Slack) retur...