Skip to main content

AWS002 - AWS Authorization Failed

Agent error code #AWS002 indicates that AWS accepted the agent's credentials but refused the operation. The identity is valid and lacks the permission the call needs.

AWS returns UnauthorizedOperation or AccessDenied in this situation, which is worth knowing if you are correlating against CloudTrail.

This is distinct from #AWS001, where the credentials themselves were rejected.

Common causes include:

  • The IAM policy attached to the identity does not grant the security group actions
  • A policy grants the actions but its Resource clause does not cover this security group
  • A permission boundary or service control policy denies the action at the account or organization level
  • The identity has read permission but not write, so listing works and granting fails

Steps to Resolve

Grant the Required Actions

The agent needs to read the group's rules and to add and remove them:

  • ec2:DescribeSecurityGroups
  • ec2:AuthorizeSecurityGroupIngress
  • ec2:RevokeSecurityGroupIngress

For an egress knoc, the corresponding ...SecurityGroupEgress actions are needed instead.

Check the Resource Scope

A policy that grants the actions on arn:aws:ec2:<region>:<account>:security-group/sg-aaaa does nothing for sg-bbbb. Confirm the policy's Resource clause covers the security group ID configured on the knoc, or use * if that suits your policy.

Simulate the Call

  1. In the AWS console, go to IAM > Policy simulator
  2. Select the identity and simulate ec2:AuthorizeSecurityGroupIngress against the security group ARN
  3. The simulator names the statement that produced a deny

Look for an Organization-Level Deny

An explicit deny in a service control policy or a permission boundary overrides any grant on the identity. If the identity's own policies look correct, check with whoever administers the account.

Back to top