用户无权执行：connect:* on resource: * with an explicit deny"

Question

I am trying to test Amazon Connect GetMetricData API in Postman. The issue I am facing is that API, in response, throws an error that says the user is not authorized to perform: connect:* on resource: * with an explicit deny."

I am wondering why I am getting this issue because the user I am using here holds full access of amazon connect. Not only Amazon Connect, also several other services' full access. You can see the issue in the following picture.

Answer 1

I saw this problem myself too. The issue that I had was the keys in the JSON payload body weren't inside the double quotes "" .

This error message looks to me like it can't identify any action or resource, so I don't think it should be related to any error-configured identity-based policy.

The error message itself isn't really descriptive about the error. I would suggest that if people encounter same problem in the future, make sure to double check on the payload body if you don't find any problem in the identity-based policy.

Answer 2

This error typically indicates that there is an IAM policy that explicitly denies the action that you're trying to perform, so you should check the policies assigned to your IAM user qayyum as a first step. If you don't find any policies with a deny statement for connect , you can try to add the following policy to your user. This policy explicitly allows GetMetricData API actions

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "connect:GetMetricData",
            "Resource": "*"
        }
    ]
}