AccessDenied when calling the GenerateServiceLastAccessedDetails

Question

The role I am assuming has the arn:aws:iam::aws:policy/SecurityAudit policy attached which includes the necessary permissions

"iam:GenerateServiceLastAccessedDetails",
"iam:Get*",
"iam:List*"

On Resource * . And yet I still get An error occurred (AccessDenied) when calling the GenerateServiceLastAccessedDetails operation: User: <assumed_role> is not authorized to perform the operation on <role_arn> . Is it a bug in AWS?

Answer 1

I found that this occurs when the arn in the request is invalid. The error message is a bug, it is an invalid input, not an access denied issue.